Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
BOF-coerce-ipp — Beacon Object File (BOF) to coerce machine account auth via IPP. | Kitploit
Tools/GitHubGitHub/sudonoodle/bof-coerce-ipp
ExploitationLateral MovementPost-ExploitationPenetration TestingCommand and ControlAuthenticationRed TeamingPayload Development
GitHubsudonoodle/bof-coerce-ipp

BOF-coerce-ipp

Beacon Object File (BOF) to coerce machine account auth via IPP.

View Repository
62101072 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

IPP Coercion BOF

A Beacon Object File (BOF) that forces a Windows machine to authenticate over HTTP as its computer account (HOSTNAME$), by triggering a directed IPP association through the WSD port monitor. This technique allows operators to coerce and relay machine-account authentication over HTTP.

Tested on Windows 11 26H2.

img-3

How It Works

The BOF was produced by tracing printui.exe during an IPP printer add, and reducing it to the observed set of API calls (using Claude Opus 5.5, Frida, and ETW). At a high-level, this BOF does the following:

  1. Opens a config handle to the WSD port monitor (OpenPrinterW(",XcvMonitor WSD Port"))
  2. Calls AssocIppDirected with the supplied URI (XcvDataW)
  3. Causes the spooler to trigger DeviceAssociationService via RPC and perform the outbound connection

Usage

Load coerce-ipp.cna in Cobalt Strike.

beacon> coerce-ipp <ip> <port>
beacon> coerce-ipp 127.0.0.1 8082

References

  • Microsoft Learn: MS-RPRN - AssocIppDirected (APMON XcvData) specification
  • Microsoft Learn: Add-Printer - Directed IPP discovery
Download Tool