NTLM Relay via Forced Authentication

RPC-based forced authentication coerces a reachable Windows host to initiate outbound NTLM authentication to an operator-controlled listener, for example through MS-EFSR (PetitPotam) or MS-RPRN (SpoolSample); Coercer implements multiple RPC methods. Responder can capture challenge-response material, while a separate relay-capable receiver such as Impacket ntlmrelayx is needed to attempt relay to a configured target. A captured NetNTLMv2 response is not a plaintext password, and relay success is a separate outcome that requires the target to accept NTLM without effective relay protections and the identity to have sufficient rights. These named-pipe examples require access to the target's RPC/SMB endpoint and an outbound callback path from the coerced host. They are Internet-applicable only when the endpoint is Internet-reachable and callback egress is permitted; an internal foothold is not otherwise required.