Coercion Ntlm Relay

Name: coercion-ntlm-relay
Author: ADScanPro

ADScanPro/Claude-AD

Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.

★ 137 Synced 1 hour ago View SKILL.md

At a glance

DevOps & Infrastructure Plugin install Auth required Actively maintained

This skill is for DevOps & Infrastructure and helps you exploit ntlm relay vulnerabilities, coerce machine account authentication, and escalate privileges via ad cs.

Install

/plugin marketplace add ADScanPro/Claude-AD
/plugin install coercion-ntlm-relay

Can use Not declared by the author

Good for Exploit ntlm relay vulnerabilities Escalate privileges via dacl abuse Coerce machine account authentication Perform active directory exploitation Establish lateral movement paths

Setup, runtime and requirements describe ADScanPro/Claude-AD, the repo this skill ships in.

Ntlm active-directory exploitation Rbcd Privilege Escalation security

Also in ADScanPro/Claude-AD

View the repo

Acl Abuse DevOps & Infrastructure

Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, Wr...

Adcs Attacks DevOps & Infrastructure

Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the tar...

Ad Environment Constraints DevOps & Infrastructure

Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KD...

Ad Methodology Legal

The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you ar...

Ad Opsec Telemetry Support

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0...

Compliance Mapping Legal

A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to auth...

Kerberos Attacks Legal

Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstr...

Other DevOps & Infrastructure skills

Wizard mattpocock/skills

Generate an interactive bash wizard that walks a human through a manual procedure — third-party setup, a one-off migration, an A→B state tra...

Git Guardrails Claude Code mattpocock/skills

Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wan...

Setup Matt Pocock Skills mattpocock/skills

Configure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before f...

Setup TS Deep Modules mattpocock/skills

Wire dependency-cruiser into a TypeScript repo so each package is a deep module — implementation hidden in subfolders, reachable only throug...

Setup Pre Commit mattpocock/skills

Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-comm...

Azure Container Registry CLI github/awesome-copilot

Manage Azure Container Registry via the az acr CLI including registries, images, cloud builds, ACR Tasks, authentication, tokens, geo-replic...