When Good Accounts Go Bad Exploiting Delegated Managed Servi...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/badsuccessor-attack-vector/
• Blog Title: When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory
• Suggested Section: Windows Privilege Escalation / Active Directory Attacks

🎯 Content Summary

BadSuccessor Attack Vector Overview

BadSuccessor abuses delegated Managed Service Accounts (dMSAs) introduced in Windows Server 2025 to escalate privileges in Active Directory. An attacker with Create Child or msDS-DelegatedManagedServiceAccount permissions on an OU can:

• Create a malicious dMSA, set its msDS-ManagedAccountPrecededByLink to a target account’s DN (for example CN=Administrator,CN=Users,DC=conto...

  🔧 Technical Details

  An attacker with Create Child or msDS-DelegatedManagedServiceAccount permissions on an OU can create a delegated MSA object, set its msDS-ManagedAccountPrecededByLink to a target account’s distinguished name and overwrite msDS-DelegatedMSAState to 2, simulating migration completion. Logging on as this dMSA grants the original account’s privileges, enabling privilege escalation to domain administrative control.

  
  

  Using t...

  🤖 Agent Actions

  Added detailed coverage of the BadSuccessor attack vector:

  1. Created new file badsuccessor-dmsa-migration-abuse.md under windows-hardening/active-directory-methodology with:
     • Technical overview of the dMSA migration abuse
     • Enumeration, exploitation, post-exploitation, detection & mitigation steps
     • Tooling list and cross-references
     • References section with blog & PoC links

  2. Updated active-directory-methodology/README.md to link this new page alongside the existing Golden gMSA/dMSA attack material.

  No other changes required.

  ✅ Review Checklist

  • Content is technically accurate
  • Formatting follows HackTricks style guidelines
  • Links and references are working
  • Content adds educational value
  • No sensitive information is exposed

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

  📚 Repository Maintenance

  • MD files processed: 866
  • MD files fixed: 1

  All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/badsuccessor-attack-vector/

Content Categories: Based on the analysis, this content was categorized under "Windows Privilege Escalation / Active Directory Attacks".

Repository Maintenance:

• MD Files Formatting: 866 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge