SMB-CVE-2025-33073

Advanced SMB Honeypot: CVE-2025-33073 Research & Implementation

Advanced SMB Honeypot: CVE-2025-33073 Research & Forensics

📌 Project Overview

This project presents a high-interaction Honeypot environment designed to research, detect, and analyze exploitation attempts targeting the SMB (Server Message Block) protocol. Specifically, the research focuses on CVE-2025-33073, exploring NTLM Reflection and Relay vulnerabilities.

The system was deployed on a public-facing VPS to simulate a vulnerable enterprise file server, attracting real-world attackers and capturing their techniques in real-time.

🚀 Key Features

• High-Interaction SMB Decoy: A fully functional Samba-based server tailored to look like a high-value target.
• Dynamic Honey-Files: Automated Python scripts (honey.py) that generate enticing files (e.g., Passwords.txt, Payroll.xlsx) upon connection to lure attackers.
• Comprehensive Forensic Suite: * Continuous Traffic Capture: Real-time packet inspection using tshark (Wireshark).
  • Advanced Logging: Tracking of timestamps, session durations, and file access patterns.
• Vulnerability Research: In-depth analysis of NTLM authentication relay mechanisms.

📁 Repository Contents

This repository includes the following primary resources to help you understand the research and recreate the environment:

1. [cve.pdf]: A comprehensive guide that explains the mechanics of the CVE-2025-33073 vulnerability, its impact, and a detailed step-by-step walkthrough of the Honeypot setup on a VPS.
2. Advanced SMB Honeypot.docx: A formal research document summarizing the project's findings, analyzed attack patterns, and the forensic data collected during the monitoring period.

🛠 Infrastructure & Setup

The honeypot was strategically deployed on a German-based VPS to maximize visibility to global scanning bots and attackers. The setup includes:

• OS: Linux-based server.
• Service: Modified Samba service.
• Isolation: The honeypot logic is isolated from the host system to prevent lateral movement or server compromise.

🔍 Forensic Monitoring

The monitoring system is built to provide 360-degree visibility into every interaction:

• Network Layer: Every packet is logged via Wireshark for post-attack dissection.
• Application Layer: SMB logs provide insights into what the attacker attempted to read, write, or execute.
• Intelligence Layer: IP-to-Geo mapping allows for identifying the source of the traffic and correlating it with known malicious botnets.