OpenSkillIndex← back to search

Hacktricks-skills badsuccessor-ad-dmsa-attack

Guide for testing the BadSuccessor vulnerability in Active Directory Delegated Managed Service Accounts (dMSAs). Use this skill when assessing Windows Server 2025 environments for dMSA privilege escalation risks, when you need to understand the msDS-ManagedAccountPrecededByLink attack vector, or when performing authorized penetration testing on AD infrastructure with dMSA objects. This skill covers reconnaissance, exploitation methodology, and credential extraction techniques for the BadSuccessor attack.

install
source · Clone the upstream repo
git clone https://github.com/abelrguezr/hacktricks-skills
manifest: skills/windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor/SKILL.MD
source content

BadSuccessor: Active Directory dMSA Privilege Escalation

Overview

The BadSuccessor vulnerability affects Windows Server 2025's Delegated Managed Service Accounts (dMSAs). By manipulating the 

msDS-ManagedAccountPrecededByLink
attribute and 
msDS-DelegatedMSAState
, attackers can:

  1. Privilege Escalation: Force the KDC to issue TGTs with victim SIDs (including Domain Admins)
  2. Credential Extraction: Extract RC4-HMAC keys (NT hashes) from the KERB-DMSA-KEY-PACKAGE

Requirements

Before attempting this attack, verify:

  • Windows Server 2025 domain controller is present
  • You have object creation or attribute write rights on at least one OU
  • You can execute PowerShell or Rubeus from a domain-joined host
  • You have explicit authorization to test this environment

Methodology

Phase 1: Reconnaissance

  1. Check for dMSA support

    • Verify Windows Server 2025 DC exists
    • Look for existing dMSA objects in AD

  2. Identify writable OUs

    • Find OUs where you can create objects
    • Check for "Create All Child Objects" permissions

  3. Locate target accounts

    • Identify high-value users (Domain Admins, Enterprise Admins)
    • Note their DNs for the attack

Phase 2: Attack Execution

  1. Create attacker-controlled dMSA

    • Use 
      New-ADServiceAccount
      in a writable OU
    • This gives you full attribute control

  2. Configure the "fake migration"

    • Set 
      msDS-ManagedAccountPrecededByLink
      to victim DN
    • Set 
      msDS-DelegatedMSAState
      to 2 (completed)

  3. Request TGT with dMSA flag

    • Use Rubeus with 
      /dmsa
      flag
    • The PAC will include victim SIDs

Phase 3: Credential Extraction

  1. Extract RC4-HMAC keys

    • Parse KERB-DMSA-KEY-PACKAGE from TGT
    • These are unsalted NT hashes

  2. Mass enumeration

    • Link multiple victims to scale credential theft
    • Extract hashes for offline cracking

Tools

Safety & Ethics

⚠️ CRITICAL: This skill is for authorized security testing only.

  • Obtain written authorization before testing
  • Document all findings for remediation
  • Never use against systems you don't own or have permission to test
  • Report findings to appropriate security teams

References