CQURE HACKS #65 NTLM reflection SMB flaw – CVE-2025-33073: From zero to Domain Admin

Source: CQURE Academy

Author: Kate Chrzan

URL: https://cqureacademy.com/blog/65-ntlm-reflection-smb-flaw/

ONE SENTENCE SUMMARY:

CVE-2025-33073 enables attackers to exploit legacy SMB protocols and coercion methods for full system compromise via NTLM relay.

MAIN POINTS:

  1. SMB signing must be disabled on the target machine to allow authentication relay attacks.
  2. The target must be vulnerable to coercion techniques like PetitPotam for exploitation to proceed.
  3. Initial attack attempts without a DNS record fail due to inability to authenticate properly.
  4. Adding a DNS record pointing to the attacker’s machine enables successful NTLM relay and SAM dump.
  5. Changing the IP to the DNS record value allows the machine to relay authentication to itself.
  6. LLMNR poisoning via Responder enables attacks without needing the DNS record.
  7. Using impacket-ntlmrelayx with netexec and coerce_plus exploits the PrinterBug vulnerability.
  8. Successful execution allows retrieval of local admin hash and local authentication.
  9. Module LSA from netexec can be used to dump LSASS and gain further access.
  10. The vulnerability highlights critical risks from legacy authentication protocols and misconfigurations.

TAKEAWAYS:

  1. Disable SMB signing only if absolutely necessary, as it allows dangerous relay attacks.
  2. Monitor and restrict DNS records to prevent abuse in authentication redirection.
  3. Employ modern authentication mechanisms to mitigate legacy protocol exploitation.
  4. Use tools like Responder and PetitPotam carefully during red team engagements or internal audits.
  5. Regularly update systems and audit for coercion vulnerabilities like PrinterBug.