Authentication Coercion Quiz

1.What is the fundamental difference between authentication coercion and LLMNR/NBT-NS poisoning?

• Coercion captures NTLMv2 hashes; poisoning captures NTLMv1 hashes
• Coercion forces a chosen machine to authenticate on demand; poisoning waits opportunistically for a victim to make a network mistake
• Coercion requires a man-in-the-middle position; poisoning does not
• Coercion only works against workstations; poisoning works against domain controllers

2.Why do coercion techniques like PrinterBug and PetitPotam cause a machine to authenticate to an attacker?

• Windows machines are misconfigured to trust all hosts on the local subnet by default
• These RPC methods accept a file or server path as an argument and connect to it, causing the target to authenticate to whichever host the attacker supplies as that path
• The attacker exploits a buffer overflow in the Windows networking stack to redirect authentication
• The target machine sends authentication proactively when it detects a new host on the network

3.Why is the coerced authentication almost always relayed rather than captured for offline cracking?

• Relay tools are more widely available than hash-cracking tools
• Machine account passwords are long and randomly generated, making offline cracking impractical: relay authenticates as the machine without needing to know the password
• The NTLMv2 hash produced by coercion is encrypted in a way that prevents offline cracking
• Offline cracking requires the attacker to be on the same subnet as the target

4.What does an attacker need before most authentication coercion techniques will work?

• Domain Administrator credentials to invoke RPC methods on a remote machine
• Valid domain credentials (even a low-privilege user or machine account), network access to the target's RPC service, and a listener ready to receive the coerced authentication
• Physical access to the target domain controller to install a listener service
• A valid service account with an SPN registered in Active Directory

5.What role does the WebClient (WebDAV) service play in authentication coercion?

• It is required for all coercion techniques to function
• It enables coercion of HTTP authentication rather than SMB, useful because HTTP relay can bypass SMB signing mitigations
• It stores the coerced NTLM hash in a local cache that the attacker can then read
• It is only present on domain controllers, restricting its use to high-value coercion targets

6.Which defense stops the relay step specifically, rather than just closing a single coercion method?

• Disabling the Print Spooler service on domain controllers
• Enforcing SMB signing and LDAP signing/channel binding domain-wide
• Requiring multi-factor authentication for all domain accounts
• Patching CVE-2021-36942 (the unauthenticated PetitPotam path)

7.An interviewer asks: 'What does authentication coercion give an attacker?' What is the strongest answer?

• Domain Admin access immediately, because the coerced DC authentication bypasses all security controls
• An NTLMv2 hash for any user account the attacker chooses to target
• On-demand machine account authentication from a chosen target, which can be relayed in real time to a service accepting NTLM, yielding access as that machine without knowing its password
• A Kerberos TGT for the coerced machine, usable for pass-the-ticket attacks