DFSNM NTLM Coercion

Abuse the Windows Distributed File System Namespace Management Protocol (MS-DFSNM) RPC interface over SMB to trigger authentication from a target Windows host toward a controlled listener. The DFSCoerce proof of concept invokes NetrDfsRemoveStdRoot through the \PIPE\NETDFS endpoint. Whether the target sends NTLM authentication, and whether a listener captures it, depends on target configuration and controls. This procedure triggers authentication only; capture, relay, cracking, and downstream access are separate actions.