A working proof-of-concept (PoC) exploit for a newly disclosed authentication reflection bypass technique has enabled researchers to obtain full NT AUTHORITY\SYSTEM shells on fully patched Windows systems, exposing a fundamental weakness in Microsoft’s.
The flaw CVE-2025-33073 was a critical Windows authentication reflection vulnerability that allowed attackers to force a privileged service to authenticate against a controlled server, then relay that authentication back to the same machine.
Documented by Synacktiv, the attack leveraged a technique called CMTI (CredMarshalTargetInfo), which embeds extra base64-encoded target information into authentication target names.
Windows Authentication Reflection Bypass
LSASS strips this data before building NTLM or Kerberos authentication blobs, meaning a crafted DNS record like srv11UWhRC... would generate authentication for srv1 a behavior that could be weaponized for local NTLM reflection or Kerberos relay.
Microsoft’s patch modified the SMB client driver (mrxsmb.sys) to reject connections to targets with embedded target information. Researchers at Synacktiv identified this as an insufficient fix, patching the symptom rather than the root cause.
The research team applied a structured bypass methodology: fully understand the patch’s scope, enumerate attack scenarios not covered by the fix, then evaluate each against strict criteria working on default configurations of Windows 11 or Server 2025, requiring no user interaction, and achieving either RCE or local privilege escalation (LPE).
Since the patch only targeted the SMB client, other protocols were evaluated. RPC/DCOM was ruled out due to mandatory packet integrity enforcement since October 2022.
HTTP via WebDAV was eliminated because the WebClient service isn’t running by default on servers, and most Windows HTTP clients lowercase target names, breaking the case-sensitive base64 CMTI technique.
The decisive discovery involved a feature introduced in Windows 11 24H2 and Windows Server 2025: the ability to connect to SMB shares on arbitrary TCP ports. Using net use \\<IP>\share /tcpport:12345, any domain user can establish an SMB connection to a non-standard port.
Crucially, the MS-SMB2 specification allows multiple authenticated sessions to be multiplexed over a single TCP connection, and the Windows SMB client reuses existing TCP connections. This meant that a low-privileged user could:
- Start a rogue SMB server on a custom port (e.g., 12345) and mount a share with unprivileged credentials, establishing a persistent TCP connection.
- Force a privileged service like LSASS to authenticate to that same share path, causing the SMB client to reuse the existing TCP connection and funnel the privileged NTLM authentication blob to the attacker’s server.
- Relay the local NTLM authentication to the real SMB service using
ntlmrelayx.py, obtaining an authenticated SMB session as NT AUTHORITY\SYSTEM.
The exploit chain used Impacket’s smbserver.py and ntlmrelayx.py, along with a modified PetitPotam.exe to coerce local LSASS authentication.
This bypass was assigned CVE-2026-24294 and patched in Microsoft’s March 2026 Patch Tuesday. The LPE scenario works by default on Windows Server 2025 but is blocked on Windows 11 24H2 due to enforced SMB signing.
Researchers note this confirms their core hypothesis: Microsoft’s original patch for CVE-2025-33073 did not address the root cause.
The ability to relay local authentications continues to expose Windows systems to privilege escalation, and a second attack vector targeting Kerberos authentication reflection via DNS control is already documented, leading to a full domain-user RCE primitive.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
