Windows Server Flaw a Shortcut to Privilege Escalation

An unpatched flaw in Windows Server 2025 that is “trivial” to exploit and present in the default configuration is a shortcut to privilege escalation and full domain compromise, warns new research from Akamai.

See Also: eBook: Why Active Directory’s 25-Year Legacy Is a Security Issue

The flaw is present in a new account type known as delegated managed service accounts, or dMSA, that Microsoft instituted as an easy path to migrating a legacy service account to a newer, more secure machine account.

The number of machine identities – often under-secured and over-privileged – has exploded, creating challenges for cyber defenders. Microsoft rolled out dMSA in a bid to prevent hackers from harvesting Active Directory credentials using a compromised account since authentication for dMSA is linked to the device identity. “Only specified machine identities mapped in Active Directory can access the account,” Microsoft says.

A key element of dMSA is that it inherits the permissions of the superseded account it replaces. It’s a feature that hackers can exploit, wrote Akamai researcher Yuval Gordon in a blog post that christened the dMSA exploitation technique as “BadSuccessor.”

The attack hinges on the way Windows handles dMSA migrations. It can be dumped into a “simulated migration” that allows any user who can control a dMSA object to tell the key distribution center that a new account is superseding a legacy account, subsequently receiving the permissions and encryption keys of that legacy account. “That’s all it takes. No actual migration. No verification. No oversight.”

The key distribution center calls a single attribute, msDA-ManagedAccountPrecededByLink, to determine which account the dMSA is meant to replace. “When a dMSA authenticates, the [privilege attribute certificate] is built based solely on this link.”

To get started with BadSuccessor, an attacker would already need permissions within an Active Directory organizational unit, meaning a breach already would have had to occurred. But the method’s stealthiness would be a boon to attackers who need elevated privileges without being caught in the act. “We didn’t change a single group membership, didn’t elevate any existing account and didn’t trip any traditional privilege escalation alerts,” Akamai wrote.

Gordon told Information Security Media Group that what piqued his interest in dMSAs was their design to inherit permissions. “That kind of behavior piques my interest as a security researcher, not because it seemed broken, but because it’s an inherently powerful operation,” Gordon said.

Akamai’s timeline shows it reporting BadSucessor to Microsoft on April 1. The company says Microsoft assessed the exploit to be of “moderate severity” – an assessment Akamai says underestimates its potential for attacks. “Once an attacker has the right permissions, they can set up a dMSA in just a few PowerShell commands,” Gordon said. “They can then use built-in tools like Task Scheduler to exploit it, no custom binaries required.”

Akamai recommends that organizations limit who has the ability to create dMSAs.