{"id":18265899,"url":"https://github.com/mpgn/backupoperatortoda","last_synced_at":"2025-05-16T05:06:50.968Z","repository":{"id":60267635,"uuid":"459745691","full_name":"mpgn/BackupOperatorToDA","owner":"mpgn","description":"From an account member of the group Backup Operators to Domain Admin without RDP or WinRM on the Domain Controller","archived":false,"fork":false,"pushed_at":"2025-01-04T14:16:46.000Z","size":12,"stargazers_count":420,"open_issues_count":1,"forks_count":53,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-04-08T15:09:35.894Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mpgn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["mpgn"]}},"created_at":"2022-02-15T20:51:46.000Z","updated_at":"2025-04-08T03:36:26.000Z","dependencies_parsed_at":"2025-01-13T18:14:57.060Z","dependency_job_id":null,"html_url":"https://github.com/mpgn/BackupOperatorToDA","commit_stats":{"total_commits":5,"total_committers":1,"mean_commits":5.0,"dds":0.0,"last_synced_commit":"25f1a34332b216be0cf78d525f475f003a4fddfa"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FBackupOperatorToDA","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FBackupOperatorToDA/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FBackupOperatorToDA/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FBackupOperatorToDA/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mpgn","download_url":"https://codeload.github.com/mpgn/BackupOperatorToDA/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254471061,"owners_count":22076585,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-05T11:20:33.846Z","updated_at":"2025-05-16T05:06:45.960Z","avatar_url":"https://github.com/mpgn.png","language":"C++","funding_links":["https://github.com/sponsors/mpgn"],"categories":[],"sub_categories":[],"readme":"# From Backup Operator To Domain Admin\n\nIf you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller.\n\nAll credit from [filip_dragovic](https://twitter.com/filip_dragovic) with his inital [POC](https://raw.githubusercontent.com/Wh04m1001/Random/main/BackupOperators.cpp) ! I build this project because I wanted to have a more generic binary with parameters and also being able to export the SAM database on the remote share ! \n\n```\nPS C:\\Users\\mpgn\\POC\u003e .\\BackupOperatorToDA.exe -h\n\nBackup Operator to Domain Admin (by @mpgn_x64)\n\n  This tool exist thanks to @filip_dragovic / https://github.com/Wh04m1001\n\nMandatory argument:\n  -t \u003cTARGET\u003e      \\\\computer_name (ex: \\\\dc01.pouldard.wizard\n  -o \u003cPATH\u003e        Where to store the sam / system / security files (can be UNC path)\n\nOptional arguments:\n\n  -u \u003cUSER\u003e        Username\n  -p \u003cPASSWORD\u003e    Password\n  -d \u003cDOMAIN\u003e      Domain\n  -h               help\n```\n\nExample: \n\n1. Using the user RON member of the Backup Operators group on another server than the DC\n2. I dump and export the SAM database on the remote share\n3. Then I read the SAM file with secretdump \n4. An I use the computer account fo the DC to dump the NTDS !\n\n![2022-02-15_15-39](https://user-images.githubusercontent.com/5891788/154149582-42652915-57bd-436d-94b6-442aec6288b6.png)\n\n### What's the magic ?\n\nThe code is really simple, there is only 3 steps:\n\n1. `RegConnectRegistryA` : Establishes a connection to a predefined registry key on another computer.\n2. `RegOpenKeyExA` : Opens the specified registry key\n3. `RegSaveKeyA` : Saves the specified key and all of its subkeys and values to a new file\n\n### Solution for Linux:\n\nIf you wanto to use impacket to exploit this : [Dumping SAM and LSA Secrets - The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets#exfiltration)\n\n\n### Blackfield from HackTheBox\n\nThis box was designed by [aas_s3curity](https://twitter.com/aas_s3curity) to exploit a user from the group \"Backup Operators\" to become domain admin and get the root flag.\nI search a little bit on the available writeups but all of them where using WinRM to exploit the \"Backup Operators\" group.\n\nWith this POC you don't need to have an access with WinRM or RPD :\n\n![htb](https://user-images.githubusercontent.com/5891788/154149493-094cada5-61a5-431d-b95c-ae5be6f65ee1.PNG)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fbackupoperatortoda","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmpgn%2Fbackupoperatortoda","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fbackupoperatortoda/lists"}