Badsuccessor Ad Dmsa Attack

BadSuccessor: Active Directory dMSA Privilege Escalation

Overview

The BadSuccessor vulnerability affects Windows Server 2025's Delegated Managed Service Accounts (dMSAs). By manipulating the msDS-ManagedAccountPrecededByLink attribute and msDS-DelegatedMSAState, attackers can:

1. Privilege Escalation: Force the KDC to issue TGTs with victim SIDs (including Domain Admins)
2. Credential Extraction: Extract RC4-HMAC keys (NT hashes) from the KERB-DMSA-KEY-PACKAGE

Requirements

Before attempting this attack, verify:

• Windows Server 2025 domain controller is present
• You have object creation or attribute write rights on at least one OU
• You can execute PowerShell or Rubeus from a domain-joined host
• You have explicit authorization to test this environment

Methodology

Phase 1: Reconnaissance

1. Check for dMSA support

   • Verify Windows Server 2025 DC exists
   • Look for existing dMSA objects in AD

2. Identify writable OUs

   • Find OUs where you can create objects
   • Check for "Create All Child Objects" permissions

3. Locate target accounts

   • Identify high-value users (Domain Admins, Enterprise Admins)
   • Note their DNs for the attack

Phase 2: Attack Execution

1. Create attacker-controlled dMSA

   • Use New-ADServiceAccount in a writable OU
   • This gives you full attribute control

2. Configure the "fake migration"

   • Set msDS-ManagedAccountPrecededByLink to victim DN
   • Set msDS-DelegatedMSAState to 2 (completed)

3. Request TGT with dMSA flag

   • Use Rubeus with /dmsa flag
   • The PAC will include victim SIDs

Phase 3: Credential Extraction

1. Extract RC4-HMAC keys

   • Parse KERB-DMSA-KEY-PACKAGE from TGT
   • These are unsalted NT hashes

2. Mass enumeration

   • Link multiple victims to scale credential theft
   • Extract hashes for offline cracking

Tools

• BadSuccessor (Akamai): https://github.com/akamai/BadSuccessor
• SharpSuccessor: https://github.com/logangoins/SharpSuccessor
• Pentest-Tools-Collection: https://github.com/LuemmelSec/Pentest-Tools-Collection

Safety & Ethics

⚠️ CRITICAL: This skill is for authorized security testing only.

• Obtain written authorization before testing
• Document all findings for remediation
• Never use against systems you don't own or have permission to test
• Report findings to appropriate security teams

References

• Akamai Security Research: https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory