PrivEsc

With the dMSA trust model explained, let’s get into the part 2, on how attackers weaponize it. The vulnerability—dubbed BadSuccessor—abuses the migration logic behind dMSAs to create a forged link between any service account and a privileged user. No actual migration required. No permissions over the target needed. Just write access to an Organizational Unit and a little Active Directory knowledge. I’m going to break down how attackers create fake dMSAs, forge migration attributes, and abuse Kerberos PAC inheritance to escalate privileges—all while staying nearly invisible to traditional detection....

Microsoft’s introduction of Delegated Managed Service Accounts (dMSAs) in Windows Server 2025 was supposed to improve security by replacing those messy legacy service accounts we’ve all been dealing with for years. But in late May 2025, security researchers found a devastating flaw in the dMSA implementation—they’re calling it “BadSuccessor”—and it can lead to complete domain takeover.This would be a 3 part blog with the first part digging into dMSA design and PAC flaw....

Introduction Active Directory (AD) security continues to be a critical concern for organizations worldwide. Among the numerous attack vectors that threaten AD environments, GPOddity stands out as a particularly sophisticated technique that leverages Group Policy Objects (GPOs) and NTLM relaying to achieve privilege escalation. First documented by security researchers at Synacktiv, this attack can bypass many common security controls and lead to domain-wide compromise. In this technical deep dive, we’ll explore how GPOddity works, why it’s dangerous, and how security teams can defend against it....