NTLM Coercion and Relay in Active Directory
PrinterBug, PetitPotam, DFSCoerce, LLMNR and DHCPv6 spoofing, SMB signing and MachineAccountQuota: how a coerced login turns into domain access.
Coercion and relay are two halves of one problem. Something makes a machine authenticate, and something else accepts that authentication without binding it to the channel. Each note below names which half it covers.
Coerced Authentication in Active Directory
Making a Windows server authenticate to an attacker-chosen destination can be more valuable than finding another password. Coerced authentication abuses legitimate interfaces to make a machine or service initiate NTLM or Kerberos authentication toward another host. PrinterBug, PetitPotam and DFSCoerce use different surfaces. The common result is the target machine authenticating with its own identity. I enumerate exposed services, validate coercion with a controlled listener and keep that proof separate from any later relay. Impact grows when the machine account has useful privilege and a target service accepts relay without adequate signing, EPA or channel binding.
1
2
impacket-ntlmrelayx -smb2support -t smb://10.10.10.20
# Listener only. Trigger the coercion from a separate shell in the lab.
MachineAccountQuota
Creating a computer account sounds like domain administration until that account becomes an attacker-controlled service principal. ms-DS-MachineAccountQuota defines how many computers an authenticated user may create by default when no other ACL blocks the operation. An attacker-created machine account has a password, SID and SPNs. That makes it useful for RBCD and other Kerberos flows. I read MachineAccountQuota, test creation with a regular account and confirm who becomes creator owner of the new object. Setting MAQ to zero removes one offensive convenience but does not fix ACLs that already allow computer creation or control through another path.
1
impacket-addcomputer -computer-name 'LABTEST01$' -computer-pass 'Temp2026!' -dc-ip 10.10.10.10 'lab.local/gabriel:Password123!'
IPv6 in Windows Networks
A network can be managed entirely with IPv4 while Windows hosts still speak IPv6 by default. Windows prefers IPv6 in several situations when the stack is enabled. That creates DHCPv6, DNS and proxy-resolution surfaces teams often forget to monitor. Spoofing attacks may try to influence DNS or WPAD and induce authentication. Offensive value depends on NTLM, signing and target protections. I first confirm whether IPv6 is active, which advertisements and DHCPv6 services exist and whether legitimate infrastructure is already present before sending anything. Disabling IPv6 without planning can break Windows. Remediation usually means securing DHCPv6, DNS, WPAD and NTLM rather than simply removing the protocol.
1
2
3
ip -6 addr
ip -6 route
tcpdump -ni eth0 'icmp6 or udp port 546 or udp port 547'
Responder and Name Resolution Poisoning
Responder without understanding the protocol becomes noise. The value comes from knowing why the host asked and which identity answered. LLMNR, NBT-NS, mDNS and WPAD appear when normal resolution fails or when applications search for automatic proxy configuration. Responder spoofs responses for some of these protocols and may capture NTLM authentication. Behavior changes with enabled modules and configuration. I observe traffic first, identify which protocols are active and enable only what is needed in the lab. That avoids unnecessary interference with legitimate services. Capturing NetNTLMv2 does not mean recovering the password. Relay, cracking and simple proof of exposure are different conclusions.
1
sudo responder -I eth0 -A
SMB
SMB appears in almost every Windows pentest, but the protocol reveals far more context than a list of shares. SMB carries file sharing, named pipes and many administrative operations. Dialect, signing and authentication change what becomes possible. SMB signing protects session integrity and directly affects NTLM relay. SMBv1 adds legacy behavior and separate risk. I enumerate dialect, signing, hostname, domain, guest access and shares before testing writes or remote execution. A writable share does not equal RCE. Value appears when a service consumes that content or the identity actually has remote administrative rights.
1
nxc smb 10.10.10.20 -u gabriel -p 'Password123!' --shares
Active Directory DNS
Domain DNS does more than resolve names. It helps Kerberos, LDAP, service discovery and authentication flows find the correct destination. AD-integrated DNS stores zones and records replicated through the directory. Dynamic updates and ACLs decide who may register or modify names. SRV records locate Domain Controllers and services. A changed sensitive A record or CNAME may redirect traffic and authentication. I enumerate zones, dynamic-update policy and ACLs on important nodes before testing a lab record. Creating a new name by design is different from overwriting an existing record. DNS node ownership changes the analysis.
1
2
dnscmd dc01 /enumzones
nslookup -type=SRV _ldap._tcp.dc._msdcs.lab.local