Password Spraying
Sub-technique of T1110 Brute Force ↗
Trying one password against many users to avoid locking accounts out.
How it shows up on Hack The Box
As soon as you have a password and a list of domain users, spray it with NetExec (--continue-on-success). Check the lockout policy first with --pass-pol.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode
Guides
- Active Directory enumeration: users, LDAP, BloodHound and password spraying 4 min read What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Active Directory
Validate users (Kerberos)
kerbrute userenum -d box.htb --dc 10.10.11.20 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
Password spraying
netexec smb 10.10.11.20 -u usuarios.txt -p 'Password123!' --continue-on-successKerbrute › Spraying
One password against every user
kerbrute passwordspray -d box.htb --dc 10.10.11.20 usuarios.txt 'Password123!'
Several passwords against one user
kerbrute bruteuser -d box.htb --dc 10.10.11.20 claves.txt usuarioMind the account lockout policy.
NetExec (nxc) › Enumeration
Password policy (before spraying)
nxc smb 10.10.11.20 -u usuario -p 'Password123!' --pass-polNo command matches.