Path: blob/master/documentation/modules/auxiliary/admin/ldap/bad_successor.md
31164 views
Vulnerable Application
This module exploits 'Bad Successor', which allows operators to elevate privileges on domain controllers running at the Windows 2025 forest functional level. Microsoft decided to introduce Delegated Managed Service Accounts (dMSA) in this forest level and they came ripe for exploitation.
Normal users can't create dMSA accounts where dMSA accounts are supposed to be created, the Managed Service Accounts OU, but if a normal user has write access to any other OU they can then create a dMSA account in said OU. After creating the account the user can edit LDAP attributes of the account to indicate that this account should inherit privileges from the Administrator user. Once this is complete we can request kerberos tickets on behalf of the dMSA account and voilà, you're admin.
The module has two actions, one for creating the dMSA account and setting it up to impersonate a high privilege user, and another action for requesting the kerberos tickets needed to use the dMSA account for privilege escalation.
Setup
Download the Windows Server 2025 .iso
Install a new Windows Server 2025 instance.
Rename the computer to
DC1and hardcode the IP address.Promote the server to a domain controller for a new forest (e.g.,
msf.local).Set the domain functional level to Windows Server 2025.
Once the domain controller is set up, create a
KdsRootKeywith an effective time at least 10 hours in the past:
Verify the key has been created and the
EffectiveTimeis in the past successfully with the following command:
Create an Organizational Unit (OU) to contain the dMSA accounts:
Open Active Directory Users and Computers (ADUC) and delegate CreateAllChild permissions on the newly created OU to a low-privilege user.
Select the new OU, right-click, and choose Properties
Select the Security tab and click Advanced
Click Add, then click Select a principal
Enter the low-privilege user's name and click OK
In the Permissions window, check the box for Create all child objects and click OK
Ensure Type is set to "Allow"
Ensure Applies to is set to "This object and all descendant objects" - important
Click OK to apply the changes and close all dialog boxes.
The low-privilege user should now have the necessary permissions to create dMSA accounts in the specified OU and edit its attributes in order to be vulnerable to Bad Successor.
Run the following command to ensure the domain controller has not had any hardening applied that might prevent BadSuccessor for being exploited:
If the output is blank, that means dSHeuristics is set to the default and the domain controller is vulnerable.
If the output contains a value ensure that the 28th character is not set to '1' (e.g.,
00000000010000000002000000000)For testing purposes, if it is set to '1', you can set it to a vulnerable value with admin privileges and the following command:
Actions
There are two kind of actions the module can run:
CREATE_DMSA - Creates a dMSA account vulnerable to BadSuccessor. [Default]
GET_TICKET - Issues a kerberos ticket for the created dMSA account to gain elevated privileges.
Verification Steps
Start msfconsole
Create a dMSA account and set it to impersonate Administrator:
Do:
use admin/ldap/bad_successorDo:
set ACTION CREATE_DMSADo:
set RHOSTNAME <domain controller FQDN>Do:
set DMSA_ACCOUNT_NAME <dMSA account name>Do:
set ACCOUNT_TO_IMPERSONATE AdministratorDo:
set LDAPDomain <domain name>Do:
set LDAPUsername <username>Do:
set LDAPPassword <password>Do:
set rhost <domain controller IP>Do:
runUse the created dMSA account to get elevated kerberos tickets:
Do:
set ACTION GET_TICKETDo:
set SERVICE cifsWith all the other options the same as before, do:
run
Options
DMSA_ACCOUNT_NAME
The name of the dMSA account to be created.
ACCOUNT_TO_IMPERSONATE
The name of the account to impersonate using the dMSA.
DC_FQDN
The fully qualified domain name (FQDN) of the domain controller.