Bypassing NTLM Reflection Mitigations: A Deep Dive into the CVE-2025-33073 Exploit Chain

A significant security milestone has been reached in the ongoing battle against NTLM reflection attacks. A new proof-of-concept (PoC) has demonstrated a successful bypass of Microsoft’s recent mitigations for CVE-2025-33073. This bypass allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM on Windows Server environments, turning what was intended to be a closed door into a viable path for local privilege escalation (LPE) and potential remote command execution (RCE).

To understand why this bypass works, we have to look at the architectural gap left by the original patch. The vulnerability originally allowed an attacker to manipulate DNS records or target names to append Base64-encoded “additional target information.” While the Local Security Authority Subsystem Service (LSASS) would strip this data before constructing Kerberos or NTLM blobs, the underlying flaw remained: an attacker could receive these authentication attempts on a rogue server and relay them back to the original target to establish a high-privilege session.

Microsoft’s initial defense focused on the SMB client path (specifically within mrxsmb.sys), blocking targets that contained this extra information. However, the mitigation failed to account for how modern SMB features can be subverted to redirect authentication flows.

The Mechanics of the Bypass: SMB Multiplexing and Custom Ports

As detailed in the research by Synacktiv, the exploit leverages a Windows feature that allows clients to specify arbitrary TCP ports when connecting to SMB shares. The attack follows a sophisticated two-stage orchestration:

1. Connection Establishment: The attacker initializes a local SMB server listening on a non-standard port. They then use the net.exe utility to mount a share from this rogue server on the target machine. This creates a persistent TCP connection. Due to SMB multiplexing, the Windows SMB client is designed to reuse existing TCP connections for efficiency.
2. Authentication Coercion: The attacker then employs a forcing primitive (such as a modified PetitPotam) to compel a privileged service—such as LSASS or another process running as SYSTEM—to access the same UNC path. Because the connection to that path is already established, the client reuses the existing TCP connection to the attacker’s rogue server.

Once the privileged service attempts to authenticate, its NTLM credentials are captured by the attacker’s server. These credentials are immediately relayed back to the target’s legitimate SMB service, effectively “reflecting” the identity of the SYSTEM account back to the machine, granting the attacker full control.

The exploit chain utilizes a highly practical toolkit: a customized Impacket-based SMB server (smbserver.py) capable of handling non-standard ports and parsing authentication blobs, ntlmrelayx for the relay mechanism, and standard Windows utilities for the initial mounting.

Critical Takeaways and Defensive Posture

This bypass serves as a stark reminder of the dangers of “partial patching.” By securing mrxsmb.sys but ignoring the broader ways protocols can force authentication and reuse connections, a structural attack surface remained wide open. Furthermore, features designed for network convenience, like arbitrary port support, can become weapons when paired with service-forcing primitives.

Note on OS Versions: While Windows Server 2025 remains highly vulnerable under default configurations, Windows 11 24H2 is significantly more resilient due to the enforcement of SMB signing by default.

Recommended Mitigations:

• Enforce SMB Signing and Channel Binding: This is the most effective defense against relay attacks.
• Restrict Authentication Vectors: Disable WebClient and WebDAV services if they are not strictly required for business operations.
• Hardened DNS Management: Tighten controls over who can modify DNS records within Active Directory to prevent initial name manipulation.
• Network Segmentation: Implement strict outbound connection controls for privileged services to prevent them from reaching unauthorized external or rogue internal IPs.
• Continuous Monitoring: Monitor for unusual SMB connection patterns, especially those involving non-standard TCP ports.

Administrators should prioritize reviewing the official MSRC advisory and ensuring all relevant security updates are applied across their environment.