Published on: 6/19/2026
restore a deleted user (`mark.davies`) → **BadSuccessor (dMSA)** to steal its hash → abuse `mark.davies`'s share ACL to drop a malicious **VS Code .vsix** → RCE as developer `ryan.brooks` → hybrid BadSuccessor on `svc_deploy` → read **VMBackups** → **volatility3** on a VM memory dump → local Administrator hash → **Pass-the-Hash** to Domain Admin.
Tags: Hack The Box lab writeup