Password spraying

People don't always choose strong passwords, neither do IT people for temporary accounts. Spraying passwords against all user accounts is effective for moving laterally and escalating privileges.


  1. To create two new users with weak passwords execute the following commands on DC02 after logging in with the Administrator user.

net user bankuser Bank2022! /add /domain
net user banktest Bank2022! /add /domain



Executing the attack

Spraying passwords was already covered in the Initial Access Attacks section.

pagePassword Spraying

But since we have a set of valid credentials of the domain now, we could request a list of all usernames and passwordspray again. We will do just that in this section.

  1. Use the discovered credentials john and password Welcome2022! with crackmapexec to authenticate over ldap and retrieve a list of all the users.

crackmapexec ldap -u john -p Welcome2022! --users

2. We discovered a couple extra users such as admin_amsterdam, IT-support01, pukcab, IT-support01, bankuser and banktest.

3. We could spray passwords using the tool spray, just like before. But lets use another tool now, like Crackmapexec. We just need to give it a list of usernames and passwords and add the --continue-on-success parameter otherwise it stops as the first succesfull login.

crackmapexec smb -u users.txt -p passwords.txt --continue-on-success

We discovered two extra set of credentials. Bankuser and banktest.



  • Implement a strong password policy:

pageStrong Password Policy



Last updated