search

Password Spraying

hashtag
Password Spraying

Once you have found several valid usernames you can try the most common passwords (keep in mind the password policy of the environment) with each of the discovered users. By default the minimum password length is 7.

Lists of common usernames could also be useful: https://github.com/insidetrust/statistically-likely-usernamesarrow-up-right

Notice that you could lockout some accounts if you try several wrong passwords (by default more than 10).

hashtag
Get password policy

If you have some user credentials or a shell as a domain user you can get the password policy with:

  • crackmapexec <IP> -u 'user' -p 'password' --pass-pol

  • enum4linx -u 'username' -p 'password' -P <IP>

  • (Get-DomainPolicy)."SystemAccess" #From powerview

hashtag
Exploitation

Using crackmapexec:

crackmapexec smb <IP> -u users.txt -p passwords.txt

Using kerbrutearrow-up-right(python) - NOT RECOMMENDED SOMETIMES DOESN'T WORK

python kerbrute.py -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
python kerbrute.py -domain jurassic.park -users users.txt -password Password123 -outputfile jurassic_passwords.txt

Kerbrute also tells if a username is valid.

Using kerbrutearrow-up-right(Go)

With Rubeusarrow-up-right version with brute module:

With the scanner/smb/smb_login module of Metasploit:

With Invoke-DomainPasswordSprayarrow-up-right

or spray (read next section).

hashtag
Lockout check

The best way is not to try with more than 5/7 passwords per account.

So you have to be very careful with password spraying because you could lockout accounts. To brute force taking this into mind, you can use sprayarrow-up-right:

hashtag
Outlook Web Access

There are multiples tools for password spraying outlook.

To use any of these tools, you need a user list and a password / a small list of passwords to spray.

hashtag
References :

PreviousPass the TicketNextForce NTLM Privileged Authentication

Last updated