How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration

A design flaw in Windows Server 2025 dMSAs enables the Golden dMSA attack: attackers with a KDS root key can generate passwords for all managed service accounts offline, bypassing authentication.

BadSuccessor lets attackers abuse a dMSA to impersonate any AD user, including Domain Admins, with no patch available. Semperis DSP adds an exposure indicator plus three IOCs to detect it.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.