ADPRIV-006: Enumeración de Backup Operators
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Backup Operators puede hacer copias de seguridad y restaurar archivos en los controladores de dominio, incluida la base de datos de AD (ntds.dit). Esto permite extraer todos los hashes de contraseñas del dominio, lo que hace que la pertenencia a Backup Operators equivalga al acceso de Domain Admin para un atacante hábil
Por qué importa
Backup Operators is one of the few built-in groups that grants a privilege which the NTFS access check explicitly honors as a bypass. SeBackupPrivilege lets the holder open any file with FILE_FLAG_BACKUP_SEMANTICS regardless of the DACL, including the live ntds.dit and the SYSTEM registry hive on a domain controller. With those two artifacts an attacker recovers the BOOTKEY, decrypts the directory database offline with secretsdump.py or similar, and obtains the NTLM hash of every account in the forest, including krbtgt. The krbtgt hash then enables Golden Ticket forgery, which provides persistent Tier-0 access independent of password resets. SeRestorePrivilege further allows writing arbitrary files back, which is the basis for the well-known DLL hijack on c:\windows\system32 used by tools like SeBackupPrivilege-Tools and PowerShell SeBackupPrivilegeUtils to escalate to SYSTEM on a DC without ever touching LSASS. Because the abuse path leaves no event in the Security Account Manager and no logon to Domain Admins, this group is a long-favored persistence and stealth-escalation channel for both red teams and threat actors. The group is also a member of the AdminSDHolder-protected set, which means its ACL is re-stamped hourly by SDProp and any clean-up of permissions on the group object itself will revert.
Ruta de ataque
1. Reconnaissance: the attacker enumerates Builtin\Backup Operators using Get-ADGroupMember "Backup Operators", net localgroup, or SharpHound (which surfaces a HasSession or MemberOf edge ending at a Tier-0 DC). 2. Credential acquisition: the attacker phishes, kerberoasts, or otherwise compromises any account that is a direct or nested member of Backup Operators. No Domain Admin compromise is required. 3. Foothold on a DC: the attacker authenticates to a domain controller using the compromised principal. Backup Operators are granted "Allow log on locally" and "Log on as a batch job" on DCs by default, so interactive logon, WinRM, or scheduled task execution all succeed. 4. NTDS extraction, raw branch: the attacker uses diskshadow.exe (built-in) to script a Volume Shadow Copy of C: and copies ntds.dit and the SYSTEM hive out of the shadow path. Example: diskshadow /s script.txt where script.txt contains add volume c: alias dc1 \u2192 create \u2192 expose %dc1% z: \u2192 then robocopy z:\windows\ntds . ntds.dit /b. The /b switch uses backup semantics, which is exactly where SeBackupPrivilege bypasses the ACL. 5. NTDS extraction, library branch: the attacker loads SeBackupPrivilegeUtils / SeBackupPrivilegeCmdLets in PowerShell (Giuliano Bertello) and calls Copy-FileSeBackupPrivilege to read C:\Windows\NTDS\ntds.dit and reg save HKLM\SYSTEM system.hive, again without ever touching the DACL. 6. Offline cracking: secretsdump.py -ntds ntds.dit -system system.hive LOCAL dumps every NTLM hash in the forest, including krbtgt. 7. Persistence: with the krbtgt hash the attacker forges Golden Tickets via mimikatz kerberos::golden or Rubeus, providing forest-wide Tier-0 access that survives password rotations of the compromised Backup Operator account. 8. Alternative escalation: with SeRestorePrivilege the attacker writes a malicious DLL into the DC system32 path that is loaded by a SYSTEM service, achieving local SYSTEM without DCSync and without dropping any classic credential-dumping tool on disk.
Cómo lo evalúa Guerrilla
Guerrilla resolves the Builtin\Backup Operators object by well-known SID (S-1-5-32-551) via Get-ADGroup -Filter { objectSID -eq "S-1-5-32-551" } so the check works in any locale where the group display name is translated. It enumerates the member linked attribute with Get-ADGroupMember -Recursive, expanding nested groups so an indirect member through, for example, a help desk role group is still reported. For each member the check pulls userAccountControl, lastLogonTimestamp, pwdLastSet, servicePrincipalName, and adminCount. Any member object whose class is user (as opposed to a managed service account or a dedicated backup computer object), or any member with a non-empty servicePrincipalName (a kerberoastable account that can therefore yield Backup Operator rights via offline cracking), is flagged. The check then reads the effective User Rights Assignment on the Default Domain Controllers GPO via secedit /export to confirm that SeBackupPrivilege and SeRestorePrivilege still resolve to the group SID, since custom URA GPOs sometimes silently remove the right and would invalidate the finding severity. Results include the member DN, samAccountName, ObjectClass, enabled state, last logon, and whether the principal is also kerberoastable or trusted for delegation.
Valor recomendado
Vacío o restringido únicamente a cuentas de servicio de copia de seguridad dedicadas. Ninguna cuenta de usuario
Remediación
Enumere la pertenencia a Backup Operators con Get-ADGroupMember -Identity 'Backup Operators'. Elimine todas las cuentas de usuario. Si las cuentas de servicio de copia de seguridad requieren la pertenencia, asegúrese de que sean dedicadas, tengan contraseñas robustas y estén supervisadas. Considere soluciones de copia de seguridad basadas en agentes que no requieran la pertenencia a Backup Operators
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-6(5)
- ANSSI
- R3
- CIS AD Benchmark
- 4.1.6
- MITRE ATT&CK
- T1003.003, T1078.002