PetitPotam
NTLM coercion via MS-EFSRPC; classic to relay the DC machine account to ADCS.
An authentication-coercion tool that abuses the MS-EFSRPC (encrypting file system) protocol: it forces a host, typically a domain controller, to authenticate to an IP you control using its machine account. The classic is relaying that DC machine account to the ADCS web endpoint (ESC8) to obtain a certificate and, with it, a TGT for the DC.
Family NTLM coercion & relay
Flags <lhost> <dc-ip>
Concepts NTLM Relay, NTLMv2 coercion with SCF/URL (IconFile UNC), ADCS ESC9 (No Security Extension)
Cheatsheet Coercion & DC CVEs (NoPac, PetitPotam, PrintNightmare)
Installation
pipx install impacketUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.