CVE-2025-33073

This PoC exploits CVE-2025-33073 by combining DNS record injection, NTLM relay attacks, and RPC coercion to achieve privilege escalation and remote code execution on Windows systems. It requires an authenticated domain user and leverages tools like samba-tool and impacket-ntlmrelayx.

This PoC exploits CVE-2025-33073 by combining DNS manipulation (dnstool.py), NTLM relay (ntlmrelayx), and coercion techniques (PetitPotam) to achieve authentication bypass and potential privilege escalation in Active Directory environments. It automates the attack chain by adding malicious DNS records, relaying NTLM authentication, and triggering coercion via SMB.

This repository contains a functional PoC exploit for CVE-2025-33073, targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled. The exploit automates NTLM relay attacks combined with DNS poisoning to achieve SYSTEM-level code execution and flag extraction.

The repository contains a Python script that detects NTLM reflection vulnerabilities (CVE-2025-33073) by sending crafted NTLM messages and analyzing responses. It does not exploit the vulnerability but scans for its presence.

This repository contains a functional exploit framework for CVE-2025-33073, a Windows SMB Client Elevation of Privilege vulnerability. The framework includes Python and PowerShell implementations for exploiting improper access control mechanisms in the SMB protocol stack.

The repository contains a functional exploit tool for CVE-2025-33073, which automates an NTLM reflection/relay attack chain via DNS coercion and PetitPotam. It includes detailed usage instructions, prerequisites, and manual exploitation steps.

This PoC chains DNS injection, NTLM relay, and RPC-based coercion to test authentication relay paths in Windows Active Directory environments. It uses `samba-tool` for DNS manipulation, `impacket-ntlmrelayx` for relaying, and `rpcping` for coercion.

This repository provides a detailed research document and forensic analysis of CVE-2025-33073, focusing on NTLM Reflection and Relay vulnerabilities in SMB. It includes a high-interaction honeypot setup with comprehensive logging and traffic capture mechanisms.

The repository contains a Python script that detects NTLM reflection vulnerabilities (CVE-2025-33073) by sending crafted NTLM messages and analyzing responses. It does not exploit the vulnerability but scans for its presence.

This PoC exploits CVE-2025-33073 by adding a malicious DNS record via LDAP, triggering NTLM relay attacks using PetitPotam/Printerbug/DFSCoerce, and executing arbitrary commands via ntlmrelayx. It chains multiple techniques to achieve remote code execution in an Active Directory environment.

The repository contains a README.md file with no exploit code or technical details about CVE-2025-33073. It appears to be a placeholder or humorous writeup unrelated to the CVE.

This script checks for CVE-2025-33073 by attempting NTLM reflection attacks via SMB signing checks and PetitPotam coercion. It requires valid credentials and a pre-registered domain for the attack to succeed.