Coercer is a multi-protocol authentication coercion tool that automatically walks through every known RPC coercion method (MS-RPRN, MS-EFSR, MS-DFSNM, MS-FSRVP, MS-EVEN and more) against a target and triggers the machine account to authenticate back to an attacker-controlled listener. The 'coerce' mode fires all applicable methods, making it the fastest way to obtain a machine-account NTLM authentication to feed into ntlmrelayx or krbrelayx. Requires a valid domain account by default and works well when you do not yet know which specific coercion vector (PrinterBug, PetitPotam, DFSCoerce, ShadowCoerce) is exposed. OPSEC: it is noisy, hitting many named pipes in one run.
Command Reference:
Target IP: 10.10.10.1
Listener IP: 10.10.10.2
Domain: test.local
Username: john
Password: password123
Coercer's 'scan' mode enumerates which RPC coercion methods and named pipes are reachable on a target without actually completing an authentication relay, letting an operator map the exposed attack surface (MS-RPRN, MS-EFSR, MS-DFSNM, MS-FSRVP, etc.) before choosing a vector. Use it as reconnaissance to confirm a host is vulnerable and to pick the quietest single method rather than blasting all of them with coerce. Typically run with a valid domain account.
Command Reference:
Target IP: 10.10.10.1
Domain: test.local
Username: john
Password: password123