Coerce Authentication via MS-EFSRPC (PetitPotam)

Uses MS-EFSRPC to make a target Windows host initiate outbound authentication to an operator-controlled SMB endpoint. Depending on the target's patch and access-control state, the resulting NTLM challenge-response may be captured or relayed to a separately vulnerable service. Coercion alone does not recover a plaintext password or provide remote execution. The procedure requires the target's SMB-hosted EFSRPC interface to be reachable; Internet use is possible only when that interface is exposed and the target can make outbound SMB to the listener.