The BackupOperatorToolkit contains different techniques allowing you to escalate from Backup Operator to Domain Admin - View it on GitHub