Keisuke Hirata

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** Improper access control in the Windows SMB client, specifically within the `mrxsmb.sys` driver, allows an authorized or unauthenticated remote attacker to elevate privileges to the `NT AUTHORITYSYSTEM` level. The issue stems from flaws in authentication reflection, where attackers can use authentication coercion techniques—such as forcing a request to a UNC path—to trick a Windows host into connecting to a malicious system. By manipulating the `CREDENTIAL TARGET INFORMATIONW` structure and forcing the use of Kerberos over NTLM, an attacker can reflect a Kerberos ticket back to the same host. This process allows the attacker to establish an SMB session as the computer account (`DOMAINMACHINE$`) and subsequently gain full system control. This flaw can be exploited via standard RPC and SMB services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.