CredCoerce
Sends RPC calls to coerce a system to authenticate to a remote system
Synopsis
CredCoerce [options] -Techniques <ComponentSelector`1[]> <ServerName> <VictimPath>
Parameters
| Name | Aliases | Value | Description |
|---|---|---|---|
| <ServerName> | <String> | Name of computer to coerce | |
| <VictimPath> | <String> | Path to send in RPC call |
Options
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AuthProxy | <EndPoint> | Endpoint of auth proxy | |
| -ConsoleOutputStyle | -OutputStyle | <OutputStyle> | Determines the output style |
| Possible values: | |||
| Freeform | |||
| Raw | |||
| Table | |||
| List | |||
| Csv | |||
| Tsv | |||
| Json | |||
| TreeTable | |||
| -Delegate | <SwitchParam> | Requests delegation (sends TGT and key for Kerberos) | |
| -OutputHeaders | <SwitchParam> | Print headers for table/list/CSV/TSV styles | |
| Default: True | |||
| -Socks5 | <host-or-ip:port> | End point of SOCKS 5 server to use | |
| -SpnOverride | <SpnMapping[]> | Specifies an SPN override | |
| -Techniques | <ComponentSelector`1[]> | List of coercion techniques to attempt | |
| Possible values: | |||
| * | |||
| Efs.OpenFile | |||
| Efs.EncryptFile | |||
| Efs.DecryptFile | |||
| Efs.QueryUsersOnFile | |||
| Efs.QueryRecoveryAgents | |||
| Efs.RemoveUsersFromFile | |||
| Efs.AddUsersToFile | |||
| Efs.FileKeyInfo | |||
| Efs.DuplicateEncryptionInfoFile | |||
| Efs.AddUsersToFileEx | |||
| Efs.FileKeyInfoEx | |||
| Efs.GetEncryptedFileMetadata | |||
| Efs.SetEncryptedFileMetadata | |||
| Efs.EncryptFileExSrv |
Authentication
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Anonymous | <SwitchParam> | Uses anonymous login | |
| -NtlmHash | <hexadecimal hash> | NTLM hash for NTLM authentication | |
| -Password | -p | <String> | Password to authenticate with |
| -UserDomain | -ud | <String> | Domain of user to authenticate with |
| -UserName | -u | <UserPrincipalName> | User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AesKey | <HexString> | AES key (128 or 256) | |
| -DelegateTicket | <String[]> | Sends the tickets (and keys) to the target for delegation | |
| -DesKey | <HexString> | DES key | |
| -Kdc | <host-or-ip:port> | KDC endpoint | |
| -Keytab | <String> | Name of keytab file | |
| -S4ProxyService | <SecurityPrincipalName> | Name of service to proxy through | |
| -S4UserCert | <String> | Name of file containing a certificate of a user to impersonate with S4U | |
| -S4UserName | <UserPrincipalName> | Name of user to impersonate with S4U | |
| -Tgt | <String> | Name of file containing a ticket-granting ticket (.kirbi or ccache) | |
| -TicketCache | <String> | Name of ticket cache file | |
| -Tickets | -Ticket | <String[]> | Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName | <UserPrincipalName> | User name to request TGT for U2U | |
| -UserCert | <String> | Name of file containing user’s certificate (for PKINIT) | |
| -UserKey | <String> | Name of file containing user’s key (for PKINIT) | |
| -UserKeyPassword | <String> | Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -NtlmVersion | <Version> | NTLM version number (a.b.c.d) | |
| -Workstation | -w | <String> | Name of workstation to send with NTLM authentication |
Connection
| Name | Aliases | Value | Description |
|---|---|---|---|
| -HostAddress | -ha | <String[]> | Network address(es) of the server |
| -UseTcp4Only | -4 | <SwitchParam> | Only use TCP over IPv4 endpoint |
| -UseTcp6Only | -6 | <SwitchParam> | Only use TCP over IPv6 endpoint |
Output
| Name | Aliases | Value | Description |
|---|---|---|---|
| -ConsoleLogFormat | -LogFormat | <LogFormat> | Sets the format of log messages written to the console |
| Default: 0 | |||
| Possible values: | |||
| Text | |||
| TextWithTimestamp | |||
| Json | |||
| -DebugLog | -vvv | <SwitchParam> | Prints debug messages |
| -Diagnostic | -vv | <SwitchParam> | Prints diagnostic messages |
| -HumanReadable | <SwitchParam> | Formats file sizes as human-readable values | |
| -LogLevel | <LogMessageSeverity> | Sets the lowest level of messages to log | |
| Possible values: | |||
| Debug | |||
| Diagnostic | |||
| Verbose | |||
| Info | |||
| Warning | |||
| Error | |||
| Critical | |||
| -Verbose | -V | <SwitchParam> | Prints verbose messages |