# DFSCoerce | PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method

**URL:** <https://onehack.st/t/dfscoerce-poc-for-ms-dfsnm-coerce-authentication-using-netrdfsremovestdroot-method/220418>\
**Category:** Tools & Scripts\
**Tags:** tools, tips-tricks\
**Created:** [June 26, 2022, 9:53am UTC](https://onehack.st/t/dfscoerce-poc-for-ms-dfsnm-coerce-authentication-using-netrdfsremovestdroot-method/220418 "2022-06-26T09:53:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [June 26, 2022, 9:53am UTC](https://onehack.st/t/dfscoerce-poc-for-ms-dfsnm-coerce-authentication-using-netrdfsremovestdroot-method/220418/1 "2022-06-26T09:53:17Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/2/f257d31d851502eedd13ee230ebbd71af1967838.png)

PoC for MS-DFSNM coerce authentication using NetrDfsRemoveStdRoot and NetrDfsAddStdRoot (found by [@xct\_de](https://twitter.com/xct_de)) methods.

Documentation: [https://docs.microsoft.com/en-us/openspecs/windows\_protocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979)

Inspired by:

PetitPotam (@topotam77)

- [https://github.com/topotam/PetitPotam](https://github.com/topotam/PetitPotam)

ShadowCoerce (@topotam77 and @\_nwodtuhs)

- [https://github.com/ShutdownRepo/ShadowCoerce](https://github.com/ShutdownRepo/ShadowCoerce)

SpoolSample (@tifkin\_)

- [https://github.com/leechristensen/SpoolSample](https://github.com/leechristensen/SpoolSample)

## GitHub:

> **[GitHub - Wh04m1001/DFSCoerce](https://github.com/Wh04m1001/DFSCoerce)**
>
> Contribute to Wh04m1001/DFSCoerce development by creating an account on GitHub.