Loading vulnerability…
BadSuccessor is an elevation-of-privilege vulnerability in Windows Kerberos affecting delegated Managed Service Account (dMSA) handling in Active Directory environments. The flaw is described by Microsoft as a relative path traversal issue in Windows Kerberos and is associated with abuse of dMSA successor relationships. Reported research indicates that an attacker with control over specific dMSA-related directory attributes can cause the Key Distribution Center (KDC) to treat an attacker-controlled dMSA as the legitimate successor of an arbitrary target account and issue credentials for that target. Microsoft’s patch added KDC-side validation requiring bidirectional links between the dMSA and the superseded account before issuing the Kerberos dMSA credential package. Successful exploitation can result in compromise of highly privileged accounts, including domain administrator-level access.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small standalone Python proof-of-concept exploit for CVE-2025-53779, accompanied by a detailed README. The structure is minimal: README.md documents the alleged vulnerability, affected Windows Server versions, usage examples, and post-exploitation workflow; exploit.py is the only code file and serves as the main entry point. The exploit is network-based and targets Microsoft Active Directory domain controllers exposing the Kerberos KDC service on port 88. According to the code and README, its core purpose is to craft malformed Kerberos authentication material—especially forged PA-PAC-REQUEST / PAC-related data—to trigger an authentication bypass in the KDC and obtain a TGT for an arbitrary domain user without valid credentials. The code imports Impacket Kerberos primitives (AS_REQ/AS_REP/TGS_REQ/TGS_REP, PAC structures, sendReceive, Principal, crypto helpers), indicating direct protocol-level interaction rather than simple wrapper logic. Notable capabilities described and partially visible in the code include: generating a random nonce for Kerberos requests; building a fake PAC with attacker-controlled group RIDs; forging Kerberos request padata intended to bypass PAC validation; scanning a host for Kerberos service availability; enumerating users on a target domain; and writing the resulting forged ticket to a Kirbi file for later use. The README explicitly positions the output for pass-the-ticket style follow-on activity using tools such as secretsdump.py or mimikatz. The script appears to be an exploit rather than a detector: it accepts --dc-ip, --domain, and --target-user for exploitation, plus --scan and --enum helper modes. Because it includes an exploitation workflow and produces a reusable authentication artifact, its maturity is best classified as OPERATIONAL rather than a bare conceptual PoC. No evidence suggests it belongs to a larger exploit framework such as Metasploit or Nuclei. Fingerprintable targets and artifacts are limited and mostly example-based: Kerberos port 88/TCP and 88/UDP, example DC IP 192.168.1.10, example AD domain corp.local, and output file ticket.kirbi. The repository does not embed hardcoded C2 infrastructure or external callback endpoints; instead, it is designed to communicate directly with a chosen domain controller supplied at runtime.
This repository contains a PowerShell script, Invoke-BadSuccessor.ps1, and a README.md. The script is a fully automated exploit targeting the BadSuccessor vulnerability (CVE-2025-53779) in Windows Server 2025 Active Directory environments. It abuses misconfigured Delegated Managed Service Account (dMSA) creation rights in Organizational Units (OUs) to escalate privileges. The script identifies OUs where the attacker has CreateChild rights, creates or reuses a computer account and a dMSA, grants the attacker full control over the dMSA, and links it to a privileged account. It then provides post-exploitation instructions for forging Kerberos tickets using Rubeus, enabling impersonation of privileged users. The exploit requires the RSAT ActiveDirectory PowerShell module and is intended for use in environments where the attacker already has some level of access. The repository is well-documented, with the README providing detailed usage instructions, function descriptions, and post-exploitation steps. No external network endpoints are hardcoded; all operations are performed against the local Active Directory environment via the PowerShell AD provider and LDAP.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
43 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A patched Windows Server 2025 dMSA vulnerability in which one-sided link manipulation allowed creation of a dMSA with an arbitrary superseded account target, enabling the KDC to issue the target's credentials.
A Windows Kerberos elevation of privilege vulnerability reported as exploited.
A zero-day privilege escalation vulnerability in Windows Kerberos that allows an authorized attacker to gain access to certain delegated managed service account (dMSA) attributes in Active Directory and escalate privileges up to domain administrator as part of the BadSuccessor attack.
A privilege escalation vulnerability in Kerberos (BadSuccessor) allowing any domain authenticated account to escalate privileges by spoofing tokens in Active Directory, potentially leading to domain admin compromise. Called a 'gift to ransomware operators.'
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.