Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

AD: BadSuccessor

Use the BadSuccessor attack for privilege escalation in an Active Directory environment.

Task 1: Introduction

Task 2: Starting the Network

Task 3: Technical Background

Task 4: Reconnaissance

Task 5: Exploitation Using Windows

Task 6: Exploitation Using Linux

Task 7: Mitigation and Conclusion

Back to all networks
Room Icon

AD: BadSuccessor

Premium room

Use the BadSuccessor attack for privilege escalation in an Active Directory environment.

medium

45 min

7,074

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Press 'Start' to begin

For those unfamiliar with Microsoft Active Directory (), it resembles a centralized directory that allows administrators to control access to various network resources. AD is common among many corporate networks; more than 20% of corporate networks are estimated to rely on AD for identity and access management. If you are unfamiliar with AD, we recommend going through the Active Directory Basics room before attempting this room.

In this room, we will cover a privilege escalation attack that abuses delegated Managed Service Account (dMSA) to succeed any account, provided that certain conditions are met. This attack was discovered by Yuval Gordon from Akamai and published in the Security Research blog, BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory. In simple terms, this attack allows a user who can control a dMSA object to achieve domain admin access.

In this room, we will cover:

  • Managed Service Account () and dMSA
  • Exploitation in a lab environment
  • Currently available mitigation techniques
Answer the questions below

Let’s explore the BadSuccessor attack.