---

This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine.

All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine (usually a domain controller) to authenticate to an arbitrary target. The root cause of this "vulnerability/feature" in each of these methods is that Windows machines automatically authenticate to other machines when trying to access UNC paths (like \\192.168.2.1\SYSVOL\file.txt).

There are currently 29 working functions in 12 protocols.

---

Protocols & Methods

• [MS-COMA]: Component Object Model Plus (COM+) Remote Administration Protocol

  • Remote call to ImportFromFile (opnum 3)

• [MS-DFSNM]: Distributed File System (DFS) Namespace Management Protocol

  • Remote call to NetrDfsAdd (opnum 1)
  • Remote call to NetrDfsAddStdRoot (opnum 12)
  • Remote call to NetrDfsRemoveStdRoot (opnum 13)
  • Remote call to NetrDfsAddRootTarget (opnum 23)
  • Remote call to NetrDfsRemoveRootTarget (opnum 24)

• [MS-DHCPM]: Microsoft Dynamic Host Configuration Protocol (DHCP) Server Management Protocol

  • Remote call to R_DhcpBackupDatabase (opnum 44)
  • Remote call to R_DhcpRestoreDatabase (opnum 45)

• [MS-DNSP]: Domain Name Service (DNS) Server Management Protocol

  • Remote call to R_DnssrvOperation — LogFilePath (opnum 0)

• [MS-EFSR]: Encrypting File System Remote (EFSRPC) Protocol

  • Remote call to EfsRpcOpenFileRaw (opnum 0)
  • Remote call to EfsRpcEncryptFileSrv (opnum 4)
  • Remote call to EfsRpcDecryptFileSrv (opnum 5)
  • Remote call to EfsRpcQueryUsersOnFile (opnum 6)
  • Remote call to EfsRpcQueryRecoveryAgents (opnum 7)
  • Remote call to EfsRpcFileKeyInfo (opnum 12)
  • Remote call to EfsRpcDuplicateEncryptionInfoFile (opnum 13)
  • Remote call to EfsRpcAddUsersToFileEx (opnum 15)
  • Remote call to EfsRpcFileKeyInfoEx (opnum 16)
  • Remote call to EfsRpcEncryptFileExSrv (opnum 21)

• [MS-FSRVP]: File Server Remote VSS Protocol

  • Remote call to IsPathSupported (opnum 8)
  • Remote call to IsPathShadowCopied (opnum 9)

• [MS-PAR]: Print System Asynchronous Remote Protocol

  • Remote call to RpcAsyncOpenPrinter (opnum 0)

• [MS-PLA]: Performance Logs and Alerts Protocol

  • Remote call to Extract (opnum 31)

• [MS-RAIW]: Remote Administrative Interface WINS

  • Remote call to R_WinsDoStaticInit (opnum 3)
  • Remote call to R_WinsBackup (opnum 7)

• [MS-RPRN]: Print System Remote Protocol

  • Remote call to RpcRemoteFindFirstPrinterChangeNotification (opnum 62)
  • Remote call to RpcRemoteFindFirstPrinterChangeNotificationEx (opnum 65)

• [MS-UAMG]: Update Agent Management Protocol

  • Remote call to IUpdateServiceManager2 AddScanPackageService (opnum 13)

• [MS-VDS]: Virtual Disk Service (VDS) Protocol

  • Remote call to IVdsVdProvider CreateVDisk (opnum 4)

Protecting against coerced authentications

Microsoft does not consider coerced authentications as security vulnerability. In their point of view, only the relaying of authentications issued from coerced authentication consitute a security vulnerability. To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators must ensure that services that permit NTLM authentication make use of protections such as Extended Protection for Authentication (EPA) or signing features such as SMB signing. The mitigations against NTLM relays are outlined in these bulletins:

• July 24, 2021 KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS)
• December 08, 2009 MSA974926: Credential Relaying Attacks on Integrated Windows Authentication
• August 12, 2009 Extended Protection for Authentication
• August 11, 2009 MSA973811: Extended Protection for Authentication

Contributing

Feel free to open a pull request to add new methods.