SMB signing enforced? You might still be vulnerable to relay. Really interesting research from @aas_s3curity demonstrating how SMB2/3 re-authentication can bypass enforced signing on affected Windows systems, potentially including Domain Controllers. The technique: • Establish an SMB session using a low-privileged account • Relay privileged NTLM or Kerberos authentication • Re-authenticate the existing session as that identity • Abuse retention of the original signing key • Access the privileged session while signing with a key you control The underlying issue is a missing identity check during re-authentication. The author released reauthx, a krbrelayx fork, alongside tooling to identify affected hosts. Important: September 2026 Windows updates appear to address this. Successful exploitation still requires a suitable privileged authentication and other relay preconditions. Excellent research building on work from Dirk-jan Mollema, Synacktiv, SySS, Semperis and SpecterOps. Write-up: blackfield.ch/blog/defeating… PoC: github.com/aas-n/reauthx #ActiveDirectory #RedTeam #WindowsSecurity