CVE-2025-33073

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-33073 8.8

Microsoft · Windows · Added 2025-10-20 · Published 2025-06-10

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityMicrosoft Windows SMB Client Improper Access Control Vulnerability

VendorMicrosoft

ProductWindows

Date added2025-10-20

Due date2025-11-10

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-284

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.

NVD: Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-31 19:43 UTC

Wall time120.0s

Searches4

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073
https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
https://www.synacktiv.com/sites/default/files/2025-06/x33fcon-reflective_relay-cve-2025-33073.pdf
https://www.praetorian.com/blog/cve-2025-33073-ntlm-reflection-one-hop/
https://github.com/mverschu/CVE-2025-33073
https://github.com/EgCupCake/cupntlm-Automated-Exploit-For-CVE-2025-33073-
https://blog.syss.com/posts/kerberos-reflection/
http://blog.async.sg/sysadmins-in-shambles.html
https://www.rbtsec.com/blog/ntlm-reflection-abusing-ntlm-for-privilege-escalation-cve-2025-33073/
https://www.depthsecurity.com/blog/using-ntlm-reflection-to-own-active-directory/
https://anorak001.github.io/posts/CVE-2025-33073/
https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3
https://batcmd.com/windows/11/services/mrxsmb/

Hunting hypothesis agent

Hunt for DNS/LLMNR responses with hostnames containing marshalled credential-target pattern 1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA pointing to external IPs, then correlate outbound NTLM from lsass.exe on TCP 445 via Sysmon Event ID 3.

Research details

ComponentSMB Client (mrxsmb.sys) - NTLM authentication relay handler and CredUnmarshalTargetInfo validation in ksecdd.sys

PreconditionsThe attacker requires valid low-privileged domain user credentials and network access to a target domain-joined Windows machine. The target must not have SMB signing enforced (disabled or not required). The attacker must be able to create DNS records in the Active Directory domain (a default permission for any authenticated domain user in AD-integrated DNS zones). The attacker registers a crafted DNS A record containing marshalled target information (Credential Target Information structure) in the hostname portion (e.g., 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA'), which when resolved by the victim SMB client, causes Windows to misinterpret the remote connection as local NTLM authentication. Using a coercion tool such as PetitPotam or Coerce_Plus, the attacker triggers lsass.exe (running as SYSTEM) on the target to initiate an outbound SMB authentication to the attacker-controlled IP. The relay server (ntlmrelayx.py) captures the NTLM authentication and relays it back to the target machine. Because Windows treats the connection as local (matching hostname logic), the SYSTEM token from the coercing lsass process is included in the relayed authentication context, granting the attacker SYSTEM-level access on the target. This enables remote SAM hive dumping, command execution, and full system compromise. The vulnerability can also be exploited via Kerberos relay when NTLM is disabled in the environment. agent

DeliveryMulti-step NTLM reflection attack: (1) Attacker registers a DNS A record in AD-integrated DNS with hostname localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA (containing marshalled Credential Target Information) pointing to attacker IP, or uses LLMNR poisoning on the local segment. (2) Attacker starts ntlmrelayx.py relay listener targeting the victim. (3) Using NetExec with DFSCoerce, PetitPotam, or Coerce_Plus module, the attacker forces the victim LSASS (running as SYSTEM) to initiate an outbound SMB connection to the attacker-controlled hostname. (4) The marshalled target info causes the SMB client to treat the connection as local NTLM authentication, embedding the SYSTEM token. (5) The relay server captures and relays the SYSTEM-level NTLM auth back to the victim for SAM dump, command execution, or LDAPS relay via partial-MIC bypass. Post-exploitation uses secretsdump.py for credential harvesting.

Public PoCyes

PoC URLs https://github.com/mverschu/CVE-2025-33073
https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
https://www.synacktiv.com/sites/default/files/2025-06/x33fcon-reflective_relay-cve-2025-33073.pdf
https://github.com/EgCupCake/cupntlm-Automated-Exploit-For-CVE-2025-33073-
https://github.com/PengSHee/1 Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0-8.9). Exploitation requires low-privileged domain credentials and DNS write access (default for domain users). The mverschu/CVE-2025-33073 PoC (715 stars) automates the full attack chain: (1) registers a DNS A record via dnstool.py with hostname 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA' (marshalled Credential Target Information structure) pointing to the attacker IP, (2) starts ntlmrelayx.py relay listener targeting the victim, (3) triggers PetitPotam/Coerce_Plus/DFSCoerce authentication coercion via NetExec (nxc) causing the victim's LSASS to initiate outbound SMB to the attacker-controlled DNS name, (4) the marshalled target info causes Windows to treat the connection as local NTLM authentication, including the SYSTEM token, (5) the relay server captures and relays the SYSTEM-level NTLM auth back to the victim for full compromise. The PoC also demonstrates bypassing SMB signing via the --remove-mic-partial flag (impacket-partial-mic fork) to relay from SMB to LDAPS. Multiple public PoC tools exist. SMB signing enforcement on the target blocks the SMB relay portion of the attack.

SummaryCVE-2025-33073 is a critical NTLM reflection vulnerability in the Windows SMB Client (mrxsmb.sys) that allows an authenticated domain user to achieve remote SYSTEM-level code execution on any domain-joined Windows machine lacking enforced SMB signing. By registering a crafted DNS record containing marshalled target information and coercing the victim's LSASS into outbound NTLM authentication, an attacker can relay the SYSTEM token back to the target for full compromise. Multiple public proof-of-concept exploits exist, and CISA has added this to the KEV catalog due to active exploitation.

Tia coverage

First reported2026-07-11

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2025-33073-a-windows-smb-client-vulnerability-allows-unautho the-gentlemen-ransomware-storm-2697-fastest-growing-raas-of-2026

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.