CVE-2025-33073 Checker Script

This rough PoC checker script tests targets for CVE-2025-33073 vulnerability by attempting to perform NTLM reflection attacks using NTLM auth coercion via samba RPC, to do this you need to have account with access to the samba.

Also you need to register a domain localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA to your attacker IP, as described below in the internal windows DNS. This is by default enabled to any account in the domain. Also LLMNR poisoning can be used instead.

Before running this script, make sure you understand how the attack works, see explanation here.

Usage

# Usage: ./CVE-2025-33073-checker.sh -u USERNAME -p PASSWORD -d DOMAIN -i IP_FILE
# Example: 
./CVE-2025-33073-checker.sh -u Administrator -p Password123 -d example.local -i samba_list_ips.txt

Setup

• Install crackmapexec, netcat and python3
• Put PetitPotam.py to the same directory as this script
• Register a domain localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA to attacker IP in DDNS. You can use dnstool.py or powermad.

Resources

• https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
• https://github.com/mverschu/CVE-2025-33073
• https://github.com/topotam/PetitPotam