NTLM Reflection is Dead, Long Live NTLM Reflection! – Deep A...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.synacktiv.com/en/publications/la-reflexion-ntlm-est-morte-vive-la-reflexion-ntlm-analyse-approfondie-de-la-cve-2025.html
• Blog Title: NTLM Reflection is Dead, Long Live NTLM Reflection! – Deep Analysis of CVE-2025-33073
• Suggested Section: generic-hacking/ntlm-reflection-kerberos-reflection-via-smb-client.md

🎯 Content Summary

Overview

CVE-2025-33073 is a logical vulnerability in the Windows Server Message Block (SMB) client that allows a remote authenticated attacker to execute arbitrary commands as SYSTEM on any machine with SMB signing not required. By abusing the SMB client’s handling of serialized Service Principal Names (SPNs), an attacker can bypass NTLM reflection mitigations and relay the SYSTEM authentication token via NTLM or Kerberos.

Discovery and Proof-of-Concept🔧 Technical Details

An NTLM reflection trick abuses the SMB client’s SPN handling: an attacker registers a DNS SPN containing serialized data (e.g., srv11UWhRCA…) pointing to a malicious IP. The client strips the serialized suffix (via CredUnmarshalTargetInfo), truncating the SPN to the service class (e.g., srv1), which is recognized as localhost. The SMB client then negotiates an NTLM local call (NTLMSSP_NEGOTIATE_LOCAL_CALL), injecting LSASS’...

🤖 Agent Actions

Added a detailed section on “NTLM & Kerberos Reflection via Serialized SPNs (CVE-2025-33073)” to

src/windows-hardening/ntlm/README.md

Key additions:
• Technical explanation of the vulnerability and local-call bypass
• Step-by-step PoC commands (DNS record, PetitPotam, ntlmrelayx / krbrelayx)
• Kernel-patch summary and mitigation strategies (SMB signing, monitoring)
• Detection ideas (network and event logs)
• References section with the Synacktiv article and MSRC advisory

This enhances the NTLM page with the newest reflection/relay technique without introducing a new file.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 853
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.synacktiv.com/en/publications/la-reflexion-ntlm-est-morte-vive-la-reflexion-ntlm-analyse-approfondie-de-la-cve-2025.html

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/ntlm-reflection-kerberos-reflection-via-smb-client.md".

Repository Maintenance:

• MD Files Formatting: 853 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0