New Attack Combines Ghost SPNs and Kerberos Reflection to Elevate Privileges on SMB Servers

Source: Cyber Security News

Author: Guru Baran

URL: https://cybersecuritynews.com/ghost-spns-and-kerberos-reflection-attack/

ONE SENTENCE SUMMARY:

CVE-2025-58726 exploits ghost SPNs and Kerberos reflection for SYSTEM-level access on Windows SMB servers lacking enforced signing.

MAIN POINTS:

  1. Vulnerability CVE-2025-58726 targets Windows SMB servers using ghost SPNs and Kerberos reflection.
  2. The flaw affects all Windows versions without enforced SMB signing, impacting default AD configurations.
  3. Attackers leverage domain users’ DNS rights to hijack ghost SPNs for unauthorized access.
  4. Kerberos reflection exploits unresolved SPNs, bypassing credential requirements for SYSTEM-level access.
  5. The attack circumvents prior mitigations like CVE-2025-33073, highlighting Kerberos’ reflection susceptibilities.
  6. Microsoft targets the srv2.sys driver for patching, focusing on SPN validity and connection source verification.
  7. Mitigation includes enforcing SMB signing, auditing SPNs, and restricting DNS write access.
  8. Network traces using Wireshark or ETW can monitor suspicious Kerberos TGS-REQ activities.
  9. October 14 patch emphasizes Active Directory hygiene to combat ghost SPN issues.
  10. Successful mitigation involves integrating current and evolving Kerberos abuse defenses.

TAKEAWAYS:

  1. Enforce SMB signing to prevent privilege escalation vulnerabilities.
  2. Regularly audit and purge ghost SPNs to improve AD security.
  3. Monitor for unusual Kerberos activities to detect potential breaches.
  4. Apply patches promptly to address emerging vulnerabilities.
  5. Strengthen domain configuration by limiting unnecessary user permissions.