An advanced privilege escalation vulnerability in Windows SMB servers exploits Ghost Service Principal Names (SPNs) and Kerberos authentication reflection to achieve remote SYSTEM-level access. Microsoft has designated this vulnerability as CVE-2025-58726, an 'SMB Server Elevation of Privilege' bug that affects all versions of Windows where SMB signing is not enforced.
See also: Impacket tool in Kali Repo has new attack routes
According to Semperis, the issue persists in environments with default Active Directory (AD) configurations, highlighting the Kerberos reflection vulnerability, despite mitigations for related vulnerabilities such as CVE-2025-33073. The vulnerability was disclosed to the Microsoft Security Response Center (MSRC) on June 25, 2025, and was confirmed as 'Important' severity by July 22.
CVE-2025-58726 exploits the interaction between unresolved SPNs and permissive DNS registration. Domain users, by default, have write permissions to DNS zones, allowing attackers to capture ghost SPN entries that point to unresolved hostnames from legacy systems, deployment errors, or hybrid configurations. This facilitates Kerberos ticket re-broadcasting, bypassing credential requirements, and providing administrative control, escalating to domain dominance if Tier 0 assets such as AD Certificate Services are compromised.
Kerberos authentication, an integral part of Windows domains, uses asymmetric tickets to securely access services, but lacks native reflection protections, unlike NTLM's channel-binding mitigations. Authentication reflection involves capturing a Kerberos AP-REQ (Application Request) and replaying it on the victim's own end, forcing self-authentication.
See also: Microsoft Patch Tuesday July 2025: Fix 137 vulnerabilities
In CVE-2025-58726, ghost SPNs (prefixed with HOST/ or CIFS/) on target computer accounts act as a pivot point. The prerequisites include low-privilege access to the domain, a target joined to the domain without SMB signing (allowing unsigned Negotiate/Kerberos blobs), and a ghost SPN, Semperis added. Attackers look up SPNs in AD via LDAP, detect unresolved ones (e.g., via nslookup failures), and register a DNS A record that maps the ghost hostname to an IP address they control, taking advantage of the default dnsHost permissions of domain users.
Tools such as PrinterBug (MS-RPRN coercion) or PetitPotam (MS-EFSRPC) enable the target machine account to request a Ticket Granting Service (TGS) ticket for the ghost SPN cifs/ghost@domain. The KDC issues this ticket, bound to the target machine account (mapped to SYSTEM in LSASS). A relay tool such as KrbRelayEx intercepts the AP-REQ during SMB session setup (SMB2 Negotiate and Session Setup phases), extracts the Kerberos token via SSPI, and relays it to the target SMB server.
The relayed token impersonates the machine account, allowing SMB commands such as Tree Connect and NTCreateAndX to be executed arbitrarily. Network sniffing reveals TGS-REQ for cifs/ghost, with the target machine as sname, confirming the reflection. This avoids the fix for CVE-2025-33073 for the SMB client, which exposed CredMarshal-based relaying. Here, the flaw lies in Kerberos' failure to validate the SPN binding to the hostname against DNS resolution, extending to protocols such as WMI (RPC/DCOM) or RDP if SPNs allow it.
See also: Denodo: Vulnerability allows remote code execution
Microsoft's remediation targets the srv2.sys driver, which drives the SMB 2.0+ server logic. In Smb2ExecuteSessionSetupReal(), the update embeds Feature_3857492281__private_IsEnabledDeviceUsage(), calling SrvAdminValidateSpn_Old() to validate the validity of the SPN against local security frameworks. For valid local SPNs, Smb2ValidateLoopbackAddress() evaluates the source IP address. Remote (non-127.0.0.1) connections return negative, terminating the session before the token is presented. This blocks the reflection cycle without changing the underlying Kerberos flows. However, residual risks remain for unpatched systems.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
