Shadowcoerce utilized the MS-FSRVP functionality.
[…] an RPC-based protocol used for creating shadow copies of file shares on a remote computer, and for facilitating backup applications in performing application-consistent backup and restore of data on SMB2 shares. — Microsoft
The Hacker Recipes explains that two of its methods, IsPathSupported and IsPathShadowCopied, accept remote UNC paths and make the target authenticate over SMB, provided the “File Server VSS Agent Service” is enabled.
The ShadowCoerce proof of concept needs domain credentials and sometimes a second try, when the FssAgent has not been asked for anything in a while.
Another vulnerability in VSS was patched in June CVE-2022-30154. A fix for shadowcoerce was either conveniently slipped in, or it was fixed “accidentally” as a by-product of the intended fix. Mitja Kolsek noticed the silent fix while the 0patch team was working on a micropatch. Microsoft made no public announcement, but a spokesperson told BleepingComputer that ShadowCoerce was mitigated with CVE-2022-30154, which affected the same component. That makes it an exception: days earlier, 0patch’s Mitja Kolsek wrote that Microsoft does not fix forced authentication issues unless an attack can be mounted anonymously, so 0patch micropatched the related DFSCoerce itself. James Forshaw would like Microsoft to be more open about this and to document material security changes in its bulletins.