BadSuccessor — Exploiting delegated Managed Service Accounts in Windows Server 2025

Understanding what is delegated Managed Service Accounts in Windows Server 2025, and how an unpatched system may be exploited for Privilege Escalation in an Active Directory environment

In doing a recent HackTheBox room, I came across this relatively new vulnerability of delegated Managed Service Accounts, and wanted to find out more about the BadSuccessor exploit. This .

4.1 In Windows:

To check for vulnerability, we can use the tool. It is in C sharp and can be compiled with Visual Studio, or using mono with xbuild in linux, as I did below:

> git clone https://github.com/logangoins/SharpSuccessor.git
> cd SharpSuccessor
> sudo apt install mono-complete -y
> xbuild SharpSuccessor.sln /p:Configuration=Release

An alternative tool is tool as below. Another exploit tool can be found

on Medium, where people are continuing the conversation by highlighting and responding to this story.