The Power of Coercion Techniques in Windows Environments

The Power of Coercion Techniques in Windows Environments

Speakers: Martin Grottenthaler, Penetration Tester, SBA Research

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=buSyt3vZRuk

Overview

In this Hacktivity conference talk, Martin Grottenthaler, a Penetration Tester at SBA Research, sheds light on the enduring power of coercion techniques within Windows environments. Far from being novel research, these methods represent well-established attack vectors that continue to plague organizations due to persistent misconfigurations and a lack of fundamental security controls. Grottenthaler emphasizes that while the underlying vulnerabilities have been known for years, they remain highly effective in real-world penetration tests, often leading to full domain compromise.

The core of the presentation revolves around how an attacker can force a Windows machine, particularly a Domain Controller, to authenticate to an arbitrary target, including an attacker-controlled system. This coerced authentication, while not directly yielding cracked credentials, can be leveraged through NTLM relay attacks to exploit a variety of misconfigurations. Grottenthaler's talk serves as a critical wake-up call for both defenders and attackers, highlighting techniques that are frequently overlooked or misunderstood, and stressing the importance of implementing accessible, yet often neglected, mitigations.

Grottenthaler's practical, consultant-driven perspective provides invaluable insights into the efficacy and impact of these techniques. He demonstrates how seemingly minor misconfigurations, when combined with coercion, can rapidly escalate privileges and grant an attacker complete control over an Active Directory domain. The talk demystifies the technical intricacies, offers clear proof-of-concept demonstrations, and provides actionable advice for strengthening Windows environments against these potent and prevalent threats.

Background

▶ Watch: What is Windows coercion and how it works (2:00)

Coercion, in the context of Windows security, refers to the act of forcing a computer to initiate an authentication attempt to a machine chosen by an attacker. This is typically achieved by exploiting legitimate, though often misconfigured, Windows protocols. As Grottenthaler explains, the simplest model involves an attacker instructing a Domain Controller (DC) to connect back to the attacker's machine. While this connection itself might seem innocuous, the crucial element is the NTLMv2 authentication hash that the DC sends to the attacker.

The history of these techniques dates back several years. One prominent example is PetitPotam, discovered by Lionel Schill in 2021. This technique leverages the Encrypting File System Remote Protocol (EFS RPC), specifically methods like EFS RPC OpenFileRaw, to compel a target machine to authenticate to an arbitrary server. Another long-standing technique is the Printer Bug, discovered in 2018, which utilizes the Print System Remote Protocol. Grottenthaler clarifies that Printer Bug is distinct from PrintNightmare, a different vulnerability related to the Print Spooler service that allows for elevation of privileges and remote code execution. While PrintNightmare led many organizations to disable the Print Spooler service (a good mitigation in itself), Printer Bug remains a viable coercion vector if the service is active.

Microsoft's response to these issues has often been to classify them as "features" rather than vulnerabilities, or to implement partial fixes that do not fully address the underlying problem. For instance, Grottenthaler notes that out of 14 RPC methods exploitable by PetitPotam, Microsoft only fixed one, leaving 13 others open. Furthermore, while initial versions of PetitPotam required no credentials, current iterations might require any valid Active Directory credentials, even weak ones, making it still highly practical for attackers. Other techniques, such as ShadowCoerce (which has been patched) and DFSCoeRce (which works specifically against Domain Controllers and remains effective), illustrate the breadth of these methods. Tools like Coercer (available on GitHub) even automate the process by attempting all known coercion techniques. The speaker stresses that these techniques are "here to stay" and will likely not see comprehensive fixes from Microsoft, necessitating a defensive focus on mitigating their impact rather than waiting for patches.

Key Findings

▶ Watch: Microsoft's PetitPotam (Pam) "fixes" are incomplete (7:00)

The central finding of Grottenthaler's talk is that while coercion techniques themselves may not be "new groundbreaking research," their persistent efficacy in real-world Windows environments makes them incredibly powerful. The core discovery is not in the initial coercion, but in the subsequent exploitation of NTLM relay against prevalent misconfigurations within Active Directory.

The NTLMv2 hash obtained from a coerced machine account, such as a Domain Controller, is typically uncrackable due to its length and complexity. However, the true danger lies in the ability to relay this authentication to another target. This relay mechanism allows an attacker to impersonate the coerced machine (e.g., the Domain Controller) on a different service or system, exploiting trust relationships and misconfigurations to achieve significant privilege escalation.

Grottenthaler highlights several critical scenarios where NTLM relay, combined with coercion, leads to severe compromise:

1. Active Directory Certificate Services (AD CS) with ESC8: Exploiting the ESC8 vulnerability (detailed in the "Certified Pre-Owned" paper by Phil Sha and Lee Christensen) allows attackers to relay a coerced Domain Controller's authentication to an AD CS HTTP endpoint. This results in the issuance of a certificate for the Domain Controller, which can then be used to request a Kerberos ticket (TGT) for the DC, ultimately granting full domain control.

1. Machine Accounts with Local Admin Privileges: A common, yet dangerous, misconfiguration where a machine account (e.g., a server) has local administrator rights on another machine. This is frequently seen in environments utilizing Microsoft Configuration Manager (SCCM/MCM), where primary site servers require local admin rights on other site system servers. An attacker can coerce the first machine, relay its authentication to the second, and gain local admin access.

1. Kerberos Unconstrained Delegation: This highly risky delegation setting allows a service to request Kerberos tickets on behalf of any user or machine that authenticates to it. If a Domain Controller is coerced to authenticate to a server configured with unconstrained delegation, a forwardable Kerberos Ticket Granting Ticket (TGT) for the DC will be stored in the server's memory (LSASS process). An attacker, already having local admin on that server, can then extract this TGT and use it to fully compromise the domain by dumping the krbtgt hash.

The talk effectively demonstrates that these coercion techniques, when chained with specific Active Directory misconfigurations, provide a fast and reliable path to full domain compromise, often within minutes, as showcased in the live lab demonstrations.

Technical Deep Dive

▶ Watch: Exploiting SCCM misconfigurations via machine account admin rights (17:00)

The technical depth of Grottenthaler's presentation lies in the practical execution of these multi-stage attacks, demonstrating how initial coercion translates into full domain compromise.

PetitPotam Coercion:

The primary tool for coercion demonstrated is PetitPotam.py, a Python script developed by Lionel Schill. This script exploits the Encrypting File System Remote Protocol (EFS RPC). Specifically, it targets RPC methods like EFS RPC OpenFileRaw to force a remote Windows machine (e.g., a Domain Controller) to initiate an SMB connection to an attacker-controlled IP address. During this connection, the coerced machine performs NTLMv2 authentication, sending its machine account hash.

In the demo, the attacker sets up responder.py on a Kali Linux machine to listen for incoming SMB connections and capture NTLMv2 hashes. Then, PetitPotam.py is executed with a dummy username (e.g., user, password) and the target Domain Controller's IP address, instructing it to connect back to the Kali machine's IP. responder successfully captures the NTLMv2 hash of the Domain Controller's machine account. Grottenthaler clarifies that while this hash is practically impossible to crack due to its length, it is invaluable for NTLM relay attacks. He also reiterates that Microsoft's "fix" for PetitPotam addressed only one of 14 RPC methods, and the requirement for "any credentials" (even weak ones) still makes it highly exploitable.

NTLM Relay with ntlmrelayx.py:

The captured NTLMv2 hash is relayed using ntlmrelayx.py, a component of the Impacket toolkit. This tool acts as a man-in-the-middle, intercepting the coerced authentication and forwarding it to a target system. The ntlmrelayx.py command often includes parameters like -t <target_server_ip> to specify the relay target and --smb2support as SMBv1 is deprecated.

Exploiting Machine Accounts as Local Admins (SCCM Scenario):

This attack vector leverages the common misconfiguration where a server's machine account holds local administrator privileges on another server. This is frequently observed in environments running Microsoft Configuration Manager (SCCM), where the primary site server's computer account often requires local admin rights on other site system servers.

The attack sequence is as follows:

1. Identify Misconfiguration: Tools like BloodHound can be used to identify such privilege relationships. Grottenthaler provides Cypher queries: MATCH (c1:Computer)-[:AdminTo]->(c2:Computer) RETURN c1.name, c2.name or MATCH (g:Group)-[:MemberOf*1..]->(c1:Computer)-[:AdminTo]->(c2:Computer) RETURN g.name, c1.name, c2.name to find computers that are local admins on others, directly or via group membership.
2. Coerce Source Machine: The attacker uses PetitPotam.py to coerce the source machine (e.g., a Domain Controller that is local admin on a target server) into authenticating to the attacker's Kali machine.
3. Relay to Target: Simultaneously, ntlmrelayx.py is running on the Kali machine, configured to relay any incoming NTLM authentication to the target server where the source machine has local admin rights.
4. Gain Local Admin: When the DC authenticates, ntlmrelayx.py relays this to the target server. The target server, recognizing the DC's authentication as a local administrator, grants the relayed session local admin privileges. ntlmrelayx.py can then dump local hashes from the target, or wmiexec.py can be used with the relayed credentials to obtain a shell on the target server as an administrator. Grottenthaler demonstrates this by using wmiexec.py with the dumped administrator hash to execute hostname and confirm local admin access on the server.

Kerberos Unconstrained Delegation Exploitation:

This is a highly potent attack that can lead to full domain compromise.

1. Identify Unconstrained Delegation: The attacker identifies a server configured for unconstrained delegation. This means the server can request Kerberos tickets on behalf of any user or machine that authenticates to it.
2. Gain Local Admin on Delegation Server: Crucially, the attacker must first gain local administrator access to this server (e.g., through the previous NTLM relay attack).
3. Coerce Domain Controller: The attacker uses PetitPotam.py to coerce the Domain Controller to authenticate to this already-compromised server with unconstrained delegation.
4. Capture TGT: When the DC authenticates, the server, due to its unconstrained delegation setting, will obtain a forwardable Kerberos Ticket Granting Ticket (TGT) for the Domain Controller and store it in its LSASS process.
5. Dump LSASS and Extract Tickets: From the Kali machine, using pypykatz (a Python equivalent of Mimikatz) or mimikatz, the attacker connects to the compromised server and dumps the LSASS process memory. This dump contains the DC's forwardable TGT.
6. Convert and Use TGT: The extracted Kerberos tickets are typically in a raw format and need conversion to the ccache format using a tool like ticketconverter.py. Once converted, klist can be used to verify the ticket.
7. Dump krbtgt Hash: With the DC's TGT, the attacker can now authenticate as the Domain Controller to itself. Grottenthaler demonstrates using secretsdump.py from Impacket with Kerberos authentication (-k -no-pass) to dump the krbtgt hash from the Domain Controller. The krbtgt hash is the master key for Kerberos in Active Directory, allowing an attacker to craft arbitrary Kerberos tickets (Golden Tickets) and maintain persistent domain administrator access, even if all other passwords are changed. The speaker notes that changing the krbtgt password twice is required to fully evict such an attacker.

The entire chain, from initial coercion to krbtgt hash acquisition, was demonstrated to take approximately 30 minutes in a lab environment.

Demo / Proof of Concept

▶ Watch: Live demo: Domain Admin takeover using Kerberos delegation (25:00)

Martin Grottenthaler's talk is heavily centered around live demonstrations, showcasing the practical application of these coercion techniques in a lab environment comprising a Kali Linux attacker machine, a Domain Controller, a Windows Server, and a Windows 11 client (though the client was not directly part of the demonstrated attack chain). All machines were running up-to-date Windows versions.

The first demonstration illustrated the basic PetitPotam coercion and NTLMv2 hash capture. On the Kali machine, responder.py was started in one terminal to listen for incoming NTLM authentication attempts. In a second terminal, PetitPotam.py was executed, supplying a dummy username (e.g., user) and the IP address of the Domain Controller. The command python3 PetitPotam.py -u user -p password <DC_IP> <Kali_IP> coerced the Domain Controller to connect back to the Kali machine. As expected, responder.py immediately captured an NTLMv2 hash belonging to the Domain Controller's machine account. Grottenthaler highlighted that while this hash itself is practically uncrackable, it's the foundation for the subsequent relay attacks.

The second demonstration moved to a more impactful scenario: NTLM relay to gain local administrator privileges on a server by exploiting an SCCM-like misconfiguration. The lab was set up so that the Domain Controller's machine account was a member of a group (Tier One Admins) that had local administrator rights on a target Windows Server.

1. NTLM Relay Setup: On the Kali machine, ntlmrelayx.py from Impacket was started, configured to target the Windows Server (-t <Server_IP>) and enable SMB2 support (--smb2support). This tool would intercept the coerced authentication and relay it to the target server.
2. Coercion: In parallel, PetitPotam.py was again used to coerce the Domain Controller to connect to the Kali machine's IP.
3. Relay and Hash Dump: As the DC authenticated to Kali, ntlmrelayx.py relayed this authentication to the target server. The server, recognizing the DC as a local administrator, granted access. ntlmrelayx.py then proceeded to dump the local hashes from the target server, including the Administrator hash.
4. Privilege Escalation Confirmation: To prove local admin access, Grottenthaler used wmiexec.py (also from Impacket) with the newly dumped Administrator hash to connect to the target server. He then executed the hostname command, successfully confirming that he had an administrator shell on the server. This demonstrated how two simple commands could lead to taking over a server.

The final and most critical demonstration involved exploiting Kerberos Unconstrained Delegation to achieve full domain compromise by obtaining the krbtgt hash. This built upon the previous step, assuming the attacker already had local admin on a server that was configured for unconstrained delegation.

1. Coercing DC to Delegation Server: PetitPotam.py was used once more to coerce the Domain Controller to connect to the compromised server that had unconstrained delegation enabled. This action caused the server to obtain and store a forwardable Kerberos TGT for the Domain Controller in its LSASS process.
2. Dumping LSASS and Extracting Tickets: On the Kali machine, pypykatz was employed to connect to the compromised server (using the previously obtained local administrator hash) and dump the LSASS process. From this dump, pypykatz extracted various credentials, including the crucial Kerberos tickets.
3. Ticket Conversion: The extracted Kerberos tickets were in a raw format and needed to be converted to the ccache format, which is usable by standard Kerberos tools. ticketconverter.py was used for this purpose.
4. krbtgt Hash Acquisition: With the ccache file containing the Domain Controller's TGT, Grottenthaler used klist to verify the ticket. Finally, secretsdump.py from Impacket was used with Kerberos authentication (-k -no-pass -dc-ip <DC_IP>) to connect to the Domain Controller as the Domain Controller and dump the krbtgt hash. This hash is the ultimate prize, allowing the attacker to forge arbitrary Kerberos tickets (Golden Tickets) and maintain persistent domain administrative control.

The series of live demonstrations vividly illustrated the chain of attack, moving from a simple network connection to complete domain takeover, emphasizing the ease and speed with which these techniques can be leveraged against common misconfigurations.

Defensive Implications

▶ Watch: Q&A: Microsoft's response and detection capabilities (36:20)

Martin Grottenthaler strongly advocates for a proactive defensive strategy, emphasizing that the solution lies not in waiting for Microsoft to fix inherent "features" of Windows protocols, but in diligently implementing existing, often long-standing, security mitigations. He stresses that these are not new measures but fundamental controls that are frequently neglected.

1. SMB Signing: This is highlighted as the most crucial mitigation. SMB signing ensures the integrity and authenticity of SMB traffic. When enabled and enforced on all servers and clients, it prevents NTLM relay attacks to those systems. If a system requires SMB signing, an attacker cannot successfully relay an NTLM authentication to it without the correct cryptographic signature. Grottenthaler urges organizations to enable this universally, particularly on critical servers like SCCM hosts and any machine where other systems might hold local admin privileges. He points out that SMB signing was introduced with Windows Server 98, underscoring its age and the lack of excuse for its absence.

1. LDAP Signing and Channel Binding: These measures protect against man-in-the-middle attacks targeting LDAP traffic. Enabling them in Active Directory, and on Linux LDAP clients where applicable, significantly enhances the security of directory service communications.

1. Constraint Delegation: This is the direct countermeasure to the highly risky unconstrained delegation. Instead of allowing a service to delegate to any other service, constrained delegation requires a whitelist of specific services to which delegation is permitted. Grottenthaler advises always using constrained delegation and keeping the list of allowed targets as short and specific as possible. While the "Account is sensitive and cannot be delegated" flag and the "Protected Users" security group are excellent mitigations for user accounts, they are generally not applicable to Domain Controllers without causing significant operational issues.

1. Auditing Local Administrators: Regularly auditing and minimizing the number of accounts (especially machine accounts) with local administrator privileges on systems is essential. Tools like BloodHound can help identify these misconfigurations. The principle is simple: no account should have local admin rights unless absolutely necessary. This reduces the attack surface for scenarios where a coerced machine account can be relayed to gain control of another system.

1. Network Segregation: Although an old concept, robust network segregation remains a highly effective defense. By limiting network connectivity between different security zones, an attacker's ability to move laterally, reach potential relay targets, and exfiltrate data is severely hampered. Grottenthaler notes that well-segmented networks make penetration tests "extremely complicated to attack."

In summary, Grottenthaler's defensive recommendations are not about revolutionary new technologies, but about disciplined implementation of established security best practices. Many of these mitigations are decades old, yet their absence continues to leave organizations vulnerable to powerful, well-known coercion and NTLM relay attacks. The onus is on defenders to prioritize these fundamental fixes rather than waiting for Microsoft to patch what it considers "features."

Key Takeaways

• Coercion Techniques are Enduring Threats: Methods like PetitPotam and Printer Bug are not new vulnerabilities but persistent "features" of Windows protocols, actively exploited in real-world attacks and unlikely to be fully patched by Microsoft.
• NTLM Relay is the Critical Link: While initial coercion yields an uncrackable NTLMv2 hash, the true power lies in NTLM relay, which allows attackers to impersonate coerced machines (e.g., Domain Controllers) on other systems.
• Misconfigurations Fuel Compromise: Coercion techniques are primarily dangerous when combined with common Active Directory misconfigurations, such as AD CS ESC8, machine accounts with excessive local admin privileges, and especially Kerberos Unconstrained Delegation.
• Full Domain Takeover is Rapid: As demonstrated, a chain of these techniques can lead to complete domain compromise and persistent access (e.g., via krbtgt hash theft) within a short timeframe, potentially as little as 30 minutes.
• Defenders Must Act Proactively: The responsibility for mitigation rests with organizations, not Microsoft. Implementing fundamental, often decades-old, security controls is paramount.
• Prioritize Foundational Mitigations: Key defensive actions include enabling SMB signing on all systems, implementing LDAP signing and channel binding, replacing unconstrained delegation with constrained delegation, rigorous auditing of local administrators, and robust network segregation.

About the Speaker(s)

Martin Grottenthaler is a Penetration Tester at SBA Research, a company based in Vienna, Austria. In his role, he is actively involved in penetration testing, red teaming exercises, and delivering training sessions focused on Windows security. While SBA Research also conducts extensive security research, Martin's primary focus is on consulting and applying known attack techniques to identify and exploit vulnerabilities in client environments.