dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025

What it is

"Ouroboros" is a self-sustaining credential-extraction and persistence technique against Windows Server 2025 delegated Managed Service Accounts (dMSAs), from Huntress in partnership with Akamai. It is not a bypass of a single check — it engineers a dMSA configuration that continuously satisfies both of the KDC's authorization gates on its own, so the loop keeps extracting a target account's NT hash after the original attacker account is deleted, after password rotation, and — per the page — while locking Domain Admins out of remediation. It works on fully patched Server 2025 in six commands.

How it works

The page's contribution beyond the summary is the two-gate mental model that explains why the post-BadSuccessor patch does not stop this:

• Gate 1 (retrieval) is genuinely closed. Unlike gMSA's constructed msDS-ManagedPassword blob, dMSA denies that attribute by default in the defaultSecurityDescriptor and adds a DC-side check blocking LDAP reads regardless of ACL. The classic "read the blob, derive keys" gMSA path does not work.
• Gate 2 (msDS-GroupMSAMembership) shifts meaning. For dMSA it authorizes who may operate as the account — who can obtain a TGT via the S4U2Self --dmsa flow and receive the KERB-DMSA-KEY-PACKAGE holding the superseded account's credentials.

Crucially, authenticating as the dMSA is separate from inheriting the superseded identity. Ouroboros satisfies both independently: it authenticates via a planted Shadow Credential and authorizes itself by writing its own SID into GroupMSAMembership.

Preconditions / Affected

Windows Server 2025 dMSAs, fully patched. Attacker needs only CreateChild on any OU/container and WriteProperty on the target account. The CVE-2025-53779 patch requires bidirectional links (msDS-ManagedAccountPrecededByLink on the dMSA and msDS-ManagedAccountSucceededByLink on the target) before the KDC issues credential material — but it does not stop a low-privilege user with the right delegated rights from creating those legitimate links, and does not govern who can write the dMSA's security-relevant attributes after creation. That post-creation ACL/attribute gap is the entry point.

Caveats

• The fetched text is truncated before the actual six-command chain walkthrough and the "how defenders should respond" section — the concrete detections and mitigations are not captured here; consult the source.
• Golden dMSA (Semperis) received no CVE: Microsoft's position is that the KDS root key is only reachable by Domain/Enterprise Admins and SYSTEM, and dMSA was never intended to protect against DC compromise.
• The authors frame Gate 1 as a real improvement; Ouroboros does not defeat it, it routes around it via Gate 2.