Chaining CVE-2025-33073 (NTLM reflection with MIC bypass) and RBCD self-delegation to reach Domain Admin when every classic SMB/LDAP relay path is blocked by the client signing flag.