Saint LoopyTicket, Who Authenticated With Himself

Patron of SMB and Kerberos, tickets that return to sender, and lucky home labs.

Life

In 2025 GuidePoint Security told the birth and death of LoopyTicket (CVE-2025-33073), found by chance in a home lab. By coercing a machine to authenticate over SMB and relaying its own Kerberos ticket back to it, you convinced it to treat that connection as local, gaining SYSTEM on any host without enforced SMB signing. Microsoft closed the loop in June 2025.

Prayer

O Saint LoopyTicket, who makes the machine authenticate with its own ticket, teach our hosts not to trust whoever claims to be them. Amen.

How to celebrate

Celebrated by installing the June 2025 patch and enforcing SMB signing, so no ticket comes back to open the front door.

A ticket returned to sender opens the door to the intruder.