windows-coerced-authentication-methods catalogs a collection of methods enabling a standard domain user to force a Windows machine's authentication to an arbitrary target. The core vulnerability stems from Windows' automatic authentication behavior when accessing UNC paths. Currently, the repository contains 15 working functions spanning 5 protocols, with ongoing efforts to test additional methods.
This project provides a comprehensive list of functional methods for coerced authentication, a technique often leveraged for privilege escalation. The code includes practical Python proof-of-concept implementations for each method. It details various protocols and specific RPC calls, offering a focused approach compared to broader vulnerability lists. The organization and documentation facilitate exploration and understanding of each method.
- MS-DFSNM: Remote calls to NetrDfsAddStdRoot and NetrDfsRemoveStdRoot for DFS Namespace Management Protocol.
- MS-EFSR: Remote calls to EfsRpcOpenFileRaw, EfsRpcEncryptFileSrv, EfsRpcDecryptFileSrv, EfsRpcQueryUsersOnFile, EfsRpcQueryRecoveryAgents, EfsRpcFileKeyInfo, EfsRpcDuplicateEncryptionInfoFile, and EfsRpcAddUsersToFileEx for Encrypting File System Remote (EFSRPC) Protocol.
- MS-FSRVP: Remote calls to IsPathSupported and IsPathCopied for File Server Remote VSS Protocol.
- MS-PAR: Remote call to RpcAsyncOpenPrinter for Print System Asynchronous Remote Protocol.
- MS-RPRN: Remote call to RpcRemoteFindFirstPrinterChangeNotificationEx for Print System Remote Protocol.
The project is actively maintained with recent updates and ongoing testing of new methods. The repository includes a section detailing mitigation techniques like Extended Protection for Authentication (EPA) and NTLM policies. Documentation is provided alongside each method, making it relatively easy to understand. The community is open to contributions and bug reports.
This repository is valuable for security researchers and penetration testers seeking to understand and exploit coerced authentication vulnerabilities in Windows environments. It provides a readily available resource for developing attack tools and understanding the underlying mechanisms. It offers a targeted approach to NTLM relay attacks, outlining relevant mitigations and security advisories.