Revised Summary: DMSA Vulnerability Enables Privilege Escalation and Credential Theft

A security researcher discovered a critical vulnerability in Active Directory's Delegated Managed Service Accounts (DMSA) that allows attackers to escalate privileges and steal credential hashes of any domain account, including highly privileged ones like KRBTGT.

Key Takeaways:

• DMSA Overview: DMSA is Microsoft's newest service account type introduced to address security limitations of legacy service accounts while providing an easier migration path that doesn't require service downtime or extensive IT involvement 8:18

• Privilege Fusion Vulnerability: The vulnerability exists in DMSA's "fusion" mechanism, which merges the privileges (PAC structure) of two linked accounts. This allows privilege inheritance without requiring actual group membership changes 16:45

• Bad Successor Attack: An attacker who gains control over a DMSA (which can be created in any organizational unit) can link it to any domain account, including highly privileged accounts like domain administrators, thereby inheriting all their privileges 20:52

• Credential Leakage: Beyond privilege escalation, the attack also exposes password hashes/credentials of the target account through the previous keys field in the DMSA key package structure. This enables attackers to obtain hashes of critical accounts like KRBTGT, facilitating golden ticket attacks 28:32

• Microsoft's Response: Microsoft classified this as a moderate severity vulnerability, stating it "does not meet the bar for immediate servicing" but will be addressed in a future update 32:14

• Detection Methods: Organizations can configure logging to d