NetExec badsuccessor Module (dMSA Abuse)

Detect BadSuccessor dMSA-link abuse: a Server 2025 delegated Managed Service Account whose msDS-ManagedAccountPrecededByLink points at a privileged user grants the dMSA's identity inheritance to anyone with write rights over it. Module flags vulnerable accounts and suggests the chain. Added in NetExec v1.5.0 (Dec 2025).

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

nxc

Category

Privilege Escalation / Delegation Abuse

Platform

linux

Requires

password

Protocols

LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap <dc-ip> -u '<user>' -p '<password>' -M badsuccessor

Examples

nxc ldap dc.corp.local -u jdoe -p 'Password123!' -M badsuccessor

Tags

netexec nxc badsuccessor dmsa delegation server-2025

References

• BadSuccessor research

Related commands

• bloodyAD add badSuccessor Create a Delegated Managed Service Account (dMSA) and chain it via…
• bloodyAD Set RBCD Configure Resource-Based Constrained Delegation: write…
• Impacket Add Computer Create a new computer account in Active Directory (used for RBCD attacks)
• Impacket getST (S4U) Abuse constrained delegation or RBCD via S4U2Self/S4U2Proxy to impersonate a user
• Impacket RBCD Write Write msDS-AllowedToActOnBehalfOfOtherIdentity to configure RBCD on a target
• PyWhisker Shadow Credentials Add shadow credentials to a target account's msDS-KeyCredentialLink attribute
• RBCD Attack Configure Resource-Based Constrained Delegation (RBCD) on a target computer
• Rubeus S4U Delegation Abuse constrained delegation via S4U on Windows using Rubeus