https://bokkapig.pages.dev/tags/cve-2025-53779/Recent content in CVE-2025-53779 on bokkapigHugoen-gbSat, 13 Jun 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/checkpoint/Sat, 13 Jun 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/checkpoint/Checkpoint is a Windows Server 2025 domain controller reachable only via AD services and SMB. Given creds alex.turner:Checkpoint2024! have no shell but hold Reanimate-Tombstones on the domain plus WriteProperty over a deleted user, mark.davies. Restoring the tombstone and abusing the post-patch BadSuccessor variant (CVE-2025-53779, dMSA credential theft — the KDC patch only blocks the one-way link, so you leak keys of any account you can write to) yields mark.davies’ NT hash. mark.davies has WRITE on the DevDrop SMB share, whose contents are auto-installed as VS Code extensions by a scheduled task running as ryan.brooks — a malicious .vsix gives a shell and user.txt. ryan.brooks has CreateChild on OU=DMSAHolder and GenericWrite on svc_deploy, so a second BadSuccessor (split across alex to create the dMSA and ryan to set the superseded link) yields svc_deploy’s hash. svc_deploy is in BackupAccess and can read a VMware snapshot of an old Server 2019 DC in the VMBackups share; volatility3 + pypykatz against the 2GB .vmem recovers a local Administrator hash that is reused as the domain Administrator, giving DCSync and root.