Skip to content

Commit 83dcd26

Browse files
NeffIsBackNeffIsBack
authored
Merge pull request Pennyw0rth#1086 from pol4ir/main
Add SMB module NTLM MIC bypass (CVE‑2025‑54918)
2 parents 0347c13 + 2347874 commit 83dcd26

2 files changed

Lines changed: 174 additions & 0 deletions

File tree

‎nxc/modules/enum_cve.py‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
from impacket.dcerpc.v5 import transport, rrp
2+
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, DCERPCException
3+
from impacket.smbconnection import SessionError
4+
from nxc.helpers.misc import CATEGORY
5+
from impacket.nmb import NetBIOSError
6+
7+
8+
class NXCModule:
9+
"""
10+
Initial module by: Mauriceter
11+
Additional authors: azoxlpf, Defte, YOLOP0wn, pol4ir, NeffIsBack
12+
"""
13+
name = "enum_cve"
14+
description = "Enumerate common (useful) CVEs by querying the registry for the OS version and UBR."
15+
supported_protocols = ["smb"]
16+
category = CATEGORY.ENUMERATION
17+
18+
def __init__(self, context=None, module_options=None):
19+
context = context
20+
self.module_options = module_options
21+
self.cve = "all"
22+
self.exploitation_details = False
23+
24+
def options(self, context, module_options):
25+
"""
26+
Be aware that these checks solely rely on the OS version and UBR reported in the registry,
27+
and do not check for the actual presence of the vulnerable components or mitigations.
28+
Test the attack yourself to verify the host is actually vulnerable.
29+
30+
Currently supported CVEs:
31+
- CVE-2025-33073 (NTLM Reflection)
32+
- CVE-2025-58726 (Ghost SPN)
33+
- CVE-2025-54918 (NTLM MIC Bypass)
34+
35+
CVE Filter for specific CVE number (default: All)
36+
EXPLOITATION Also provide sources for exploitation details (default: False)
37+
"""
38+
self.listener = None
39+
if "CVE" in module_options:
40+
self.cve = module_options["CVE"].lower()
41+
if "EXPLOITATION" in module_options:
42+
self.exploitation_details = module_options["EXPLOITATION"].lower() in ["true", "1", "yes"]
43+
44+
def is_vulnerable(self, major, minor, build, ubr, msrc):
45+
key = (major, minor, build)
46+
min_patched_ubr = msrc.get(key)
47+
if min_patched_ubr is None:
48+
return None # Unknown product
49+
if ubr is None:
50+
return None
51+
return ubr < min_patched_ubr
52+
53+
def on_login(self, context, connection):
54+
connection.trigger_winreg()
55+
56+
# Connect to RemoteRegistry to read UBR from registry
57+
rpc = transport.DCERPCTransportFactory(r"ncacn_np:445[\pipe\winreg]")
58+
rpc.set_smb_connection(connection.conn)
59+
if connection.kerberos:
60+
rpc.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost)
61+
dce = rpc.get_dce_rpc()
62+
if connection.kerberos:
63+
dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
64+
65+
# Query the UBR
66+
try:
67+
dce.connect()
68+
dce.bind(rrp.MSRPC_UUID_RRP)
69+
# Reading UBR from registry
70+
hRootKey = rrp.hOpenLocalMachine(dce)["phKey"]
71+
hKey = rrp.hBaseRegOpenKey(dce, hRootKey, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion")["phkResult"]
72+
ubr = rrp.hBaseRegQueryValue(dce, hKey, "UBR")[1]
73+
dce.disconnect()
74+
if not ubr:
75+
context.log.info("Could not determine OS version from registry")
76+
return
77+
else:
78+
context.log.debug(f"OS version from registry: {connection.server_os_major}.{connection.server_os_minor}.{connection.server_os_build}.{ubr}")
79+
except DCERPCException as e:
80+
context.log.fail(f"DCERPC error: {e}")
81+
return
82+
except SessionError as e:
83+
if "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
84+
context.log.info(f"RemoteRegistry is probably deactivated: {e}")
85+
else:
86+
context.log.fail(f"Unexpected error: {e}")
87+
return
88+
except (BrokenPipeError, ConnectionResetError, NetBIOSError, OSError) as e:
89+
context.log.fail(f"DCERPC transport error: {e.__class__.__name__}: {e}")
90+
return
91+
92+
# Check each CVE
93+
for cve in self.CVE_PATCHES:
94+
if self.cve == "all" or self.cve.lower() == cve.lower():
95+
if self.is_vulnerable(connection.server_os_major, connection.server_os_minor, connection.server_os_build, ubr, self.CVE_PATCHES[cve]["patches"]):
96+
if connection.conn.isSigningRequired() and "signing_message" in self.CVE_PATCHES[cve]: # Special conditional message for some CVEs
97+
context.log.highlight(f"{cve.upper()} - {self.CVE_PATCHES[cve]['alias']} - {self.CVE_PATCHES[cve]['signing_message']}")
98+
else:
99+
context.log.highlight(f"{cve.upper()} - {self.CVE_PATCHES[cve]['alias']} - {self.CVE_PATCHES[cve]['message']}")
100+
if self.exploitation_details:
101+
context.log.highlight(f"Exploitation details: {self.CVE_PATCHES[cve]['exploitation']}")
102+
else:
103+
context.log.info(f"Not vulnerable to {self.CVE_PATCHES[cve]['alias']} (UBR {ubr} >= {self.CVE_PATCHES[cve]['patches'].get((connection.server_os_major, connection.server_os_minor, connection.server_os_build), 'unknown')})")
104+
105+
# patches: key = (major, minor, build), value = minimum patched UBR
106+
CVE_PATCHES = {
107+
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073
108+
"CVE-2025-33073": {
109+
"alias": "NTLM reflection",
110+
"patches": {
111+
(6, 0, 6003): 23351, # Windows Server 2008 SP2
112+
(6, 1, 7601): 27769, # Windows Server 2008 R2 SP1
113+
(6, 2, 9200): 25522, # Windows Server 2012
114+
(6, 3, 9600): 22620, # Windows Server 2012 R2
115+
(10, 0, 10240): 21034, # Windows 10 1507
116+
(10, 0, 14393): 8148, # Windows Server 2016 / Win10 1607
117+
(10, 0, 17763): 7434, # Windows Server 2019 / Win10 1809
118+
(10, 0, 19044): 5965, # Windows 10 21H2
119+
(10, 0, 20348): 3807, # Windows Server 2022
120+
(10, 0, 22621): 5472, # Windows 11 22H2
121+
(10, 0, 25398): 1665, # Windows Server 2022 23H2
122+
(10, 0, 26100): 4270, # Windows Server 2025 / Win11 24H2
123+
},
124+
"message": "Relay possible from SMB to any protocol",
125+
"signing_message": "can relay SMB to other protocols except SMB",
126+
"exploitation": "https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025",
127+
},
128+
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-58726
129+
"CVE-2025-58726": {
130+
"alias": "Ghost SPN",
131+
"patches": {
132+
(6, 0, 6003): 23571, # Windows Server 2008 SP2
133+
(6, 1, 7601): 27974, # Windows Server 2008 R2 SP1
134+
(6, 2, 9200): 25722, # Windows Server 2012
135+
(6, 3, 9600): 22824, # Windows Server 2012 R2
136+
(10, 0, 10240): 21161, # Windows 10 1507
137+
(10, 0, 14393): 8519, # Windows Server 2016 / Win10 1607
138+
(10, 0, 17763): 7919, # Windows Server 2019 / Win10 1809
139+
(10, 0, 19044): 6456, # Windows 10 21H2
140+
(10, 0, 20348): 4294, # Windows Server 2022
141+
(10, 0, 22621): 6060, # Windows 11 22H2
142+
(10, 0, 25398): 1913, # Windows Server 2022 23H2
143+
(10, 0, 26100): 6899, # Windows Server 2025 / Win11 24H2
144+
(10, 0, 26200): 6899, # Windows 11 25H2
145+
},
146+
"message": "Relay possible from SMB using Ghost SPN for Kerberos reflection",
147+
"signing_message": "Relay possible from SMB using Ghost SPN (non HOST/CIFS) for Kerberos reflection to other protocols except SMB",
148+
"exploitation": "https://www.semperis.com/blog/exploiting-ghost-spns-and-kerberos-reflection-for-smb-server-privilege-elevation/",
149+
},
150+
151+
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54918
152+
# https://decoder.cloud/2025/11/24/reflecting-your-authentication-when-windows-ends-up-talking-to-itself/
153+
"CVE-2025-54918": {
154+
"alias": "NTLM MIC Bypass",
155+
"patches": {
156+
(6, 0, 6003): 23529, # Windows Server 2008 SP2
157+
(6, 1, 7601): 27929, # Windows Server 2008 R2 SP1
158+
(6, 2, 9200): 25675, # Windows Server 2012
159+
(6, 3, 9600): 22774, # Windows Server 2012 R2
160+
(10, 0, 10240): 21128, # Windows 10 1507
161+
(10, 0, 14393): 8422, # Windows Server 2016
162+
(10, 0, 17763): 7792, # Windows Server 2019 / Win10 1809
163+
(10, 0, 19044): 6332, # Windows 10 21H2
164+
(10, 0, 20348): 4171, # Windows Server 2022
165+
(10, 0, 22621): 5909, # Windows 11 22H2
166+
(10, 0, 22631): 5909, # Windows 11 23H2
167+
(10, 0, 26100): 6508, # Windows Server 2025 / Win11 24H2
168+
},
169+
"message": "Note that without CVE-2025-33073 only Windows Server 2025 is exploitable",
170+
"exploitation": "https://yousofnahya.medium.com/hands-on-exploitation-of-cve-2025-54918-cf376ebb40e1",
171+
}
172+
}

‎nxc/modules/ntlm_reflection.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ def is_vulnerable(self, major, minor, build, ubr):
4747
return ubr < min_patched_ubr
4848

4949
def on_login(self, context, connection):
50+
context.log.fail("[REMOVED] This module has been integrated into the enum_cve module.")
51+
return
5052
self.context = context
5153
self.connection = connection
5254
connection.trigger_winreg()

0 commit comments

Comments
 (0)