Coerced Authentication

If an adversary can persuade a Windows host to connect to an attacker controlled system, they can intercept NTLM challenge response credentials, or relay NTLM credentials to other hosts.

Often this is done through performing a Man in the Middle attack against a broadcast protocol such as LLMNR or NBNS, with tools like Responder.py.

However, it’s possible to coerce Windows hosts to connect to an attacker controlled system using a number of Remote Procedure Call (RPC) methods.

In this article we will look at testing a number of coercion techniques against a fully patched Windows Server 2022 Domain Controller.

Common methods include include;

• MS-EFSR: Encrypting File System Remote Protocol (PetitPotam)
• MS-RPRN: Print System Remote Protocol (PrinterBug)
• MS-FSRVP: File Server Remote VSS Protocol (ShadowCoerce)
• MS-DFSNM: Distributed File System: Namespace Management Protocol (DFSCoerce)

---

Coercion Methods

PetitPotam

PetitPotam is a vulnerability discovered in 2021 that targets the Encrypting File Services Remote Procedure Calls (EFSRPC). A script is available here to exploit the vulnerability.

Microsoft released two patches to address the vulnerability;

• CVE-2021-36942 – Prevent usage of the API calls OpenEncryptedFileRawA and OpenEncryptedFileRawW through LSARPC interface.

• CVE-2022-26925 – Due to a code regression, Microsoft reintroduced the bug. But this time it could be triggered by an unauthenticated user The associated patch disabled anonymous LSARPC authentication.

Being patched, this did not work on the Server 2022 system.

PrinterBug (aka SpoolSample)

The PrinterBug targets the MS-RPRN protocol and allows a domain user to request a system running the print spooler service to authenticate to an arbitrary host. The vulnerability is tracked in CVE-2021-34527.

With responder running on the attacker host, we can see the machine account credentials have been captured;

That proved the coerced authentication worked, provided you have a user account within the domain and the print spooler service is running on the target system.

DFSCoerce

This vulnerability takes advanced on the MS-DFSNM protocol. A script to exploit this vulnerability is available here.

Once again, our hashes are successfully captured;

ShadowCoerce

This targets the MS-FSRVP protocol.

This unfortunately did not work as it was mitigated as part of CVE-2022-30154.

---

Coercer

Coercer is a tool that includes 12 different methods to coerce authentication, including all of the above. It can be run with;

The script attempts a number of methods to coerce authentication;

---

Exploitation

There are two ways we can exploit the credentials, either by relaying them to an unconstrained delegation host, or relaying them to an ADCS server.

Certificate Service Relaying

We configure a default installation of Active Directory Certificate Services (ADCS), with web enrolment on SERVER2. We can identify ADCS servers using the certutil.exe executable in windows;

Alternatively, from a Linux host we can run certipy to enumerate certificate services and their associated templates;

Since coerced authentication will be received by the machine account of our target domain controller (DC01$), we will be targeting the DomainController certificate template;

As per our previous example, we can use printerbug.py to trigger an authentication request from the domain controller to our attacker host;

We then use, impacket-ntlmrelayx to relay the authentication request to the ADCS server and issue a certificate for the DC01$ machine account, which is provided in Base64 format.

We can then import the ticket into our session using Rubeus;

With the Domain Controllers ticket in memory, we can then perform a DCSync attack against the ktbtgt account using Mimikatz;

---

Unconstrained Delegation Exploitation

If your not familiar with Kerberos delegation, I’ve covered it in more depth here. In this scenario, user alice has local administrator rights on SERVER01. This server has unconstrained delegation enabled.

Alice uses SpoolSample.exe (a variation of the PrinterBug) to coerce the domain controller DC01 to authenticate to SERVER01;

Rubeus is then used to capture the Kerberos TGT from DC01;

We can then import the ticket into the users session;

At this point, we could once again perform a DCSync attack with Mimikatz.

---

What about SMB to LDAP Relaying?

Relaying SMB to LDAP won’t be possible in this configuration due to the Message Integrity Code (MIC). NTLMv1 does not support a MIC so that would work, however this would require the domain functional level to set to below 2012. The NtlmMinClientSec & NtlmMinServerSec registry keys define this behaviour;

Value	Session Security
0x0	No security
0x10	Require Integrity
0x20	Require Confidentiality
0x80000	Require NTLMv2
0x20000000	Require 128-bit encryption

---

In Conclusion

From testing against a Windows Server 2022 host, the PrinterBug and DFSCoerce are still working in October 2023.

• MS-EFSR: Encrypting File System Remote Protocol (PetitPotam) – Patched in CVE-2022-26925

• MS-RPRN: Print System Remote Protocol (PrinterBug) – working (requires an active Print Spooler)

• MS-FSRVP: File Server Remote VSS Protocol (ShadowCoerce) – Patched in CVE-2022-30154

• MS-DFSNM: Distributed File System: Namespace Management Protocol (DFSCoerce) – working

The reason for these outstanding vulnerabilities is Microsoft do not consider forced authentication an issue, unless the condition is triggered anonymously (i.e without any user credentials).

Once you have managed to coerce authentication, you then have two options;

• Relay the credentials to a host with unconstrained delegation
• Relay the credentials to an ADCS instance