dMSA - Windows Server 2025
Managed Service Accounts (dMSAs) - BadSuccessor Exploit
Last updated
Managed Service Accounts (dMSAs) - BadSuccessor Exploit
Last updated
Delegated Managed Service Accounts (dMSAs) is a new feature introduced in Windows Server 2025.
dMSAs are designed to streamline the management of service accounts by allowing a new dMSA to inherit permissions from an older account it replaces
Attackers can simulate this migration by simply modifying two attributes on a dMSA object: msDS-ManagedAccountPrecededByLink and msDS-DelegatedMSAState. By setting the first attribute to reference a target user and the second to “2” (indicating migration completion), an attacker can trick the system into believing a legitimate migration occurred.
Automatically gain all the permissions of the targeted user, including highly privileged accounts like Domain Admins. Crucially, this attack doesn’t require any direct permissions on the targeted user’s account itself, only the ability to create or control a dMSA.
Requirements: Windows Server 2025 DC + CreateChild on any OU
Verify whether the DC is Windows Server 2025
Identify which identities have permissions to create dMSAs in the domain, and which OUs are affected - highlighting where the BadSuccessor attack could be executed
Set 3 deny ACEs on OUs to prevent DMSA abuse.
Disable Implicit Owner Rights
Don’t have a KDS Root Key - Check for KDS
Encompassing both external and internal enumeration techniques, the book delves into attacking routers and services, establishing footholds, privilege escalation, lateral movement, and exploiting databases and Active Directory.
