> For the complete documentation index, see [llms.txt](https://ad-lab.gitbook.io/building-a-windows-ad-lab/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ad-lab.gitbook.io/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/active-directory-attacks/password-spraying.md).

# Password spraying

People don't always choose strong passwords, neither do IT people for temporary accounts. Spraying passwords against all user accounts is effective for moving laterally and escalating privileges.

## Configuring

1. To create two new users with weak passwords execute the following commands on `DC02` after logging in with the `Administrator` user.

```
net user bankuser Bank2022! /add /domain
net user banktest Bank2022! /add /domain
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F5R0KFaGheaLEgEmn7RRe%2Fimage.png?alt=media&amp;token=b3542d7d-cf05-413b-b7b6-ab02a73be4ed" alt=""></div>

## Attacking

### Tools

* [Kerbrute](https://github.com/ropnop/kerbrute)
* [Spray](https://github.com/Greenwolf/Spray)
* [Crackmapexec](https://github.com/byt3bl33d3r/CrackMapExec)
* [Domainpasswordspray](https://github.com/dafthack/DomainPasswordSpray)
* [Rubeus](https://github.com/GhostPack/Rubeus)

### Executing the attack

Spraying passwords was already covered in the Initial Access Attacks section.

{% content-ref url="/pages/Q8xmp0DnTS5Z7XgSvWnd" %}
[Password Spraying](/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/initial-access-attacks/username-enumeration/password-spraying.md)
{% endcontent-ref %}

But since we have a set of valid credentials of the domain now, we could request a list of all usernames and passwordspray again. We will do just that in this section.

1. Use the discovered credentials `john` and password `Welcome2022!` with crackmapexec to authenticate over ldap and retrieve a list of all the users.

```
crackmapexec ldap 10.0.0.3 -u john -p Welcome2022! --users
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FLKAjqTZNEo2aiHLNA59U%2Fimage.png?alt=media\&token=32b2a29f-8f11-46e9-ad9d-8fa57d228f54)

2\. We discovered a couple extra users such as `admin_amsterdam`, `IT-support01`, `pukcab`, `IT-support01`, `bankuser` and `banktest`.

3\. We could spray passwords using the tool spray, just like before. But lets use another tool now, like Crackmapexec. We just need to give it a list of usernames and passwords and add the `--continue-on-success` parameter otherwise it stops as the first succesfull login.

```
crackmapexec smb 10.0.0.3 -u users.txt -p passwords.txt --continue-on-success
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FgLQR8YwDpQ7NpJ9SHTYf%2Fimage.png?alt=media&amp;token=92c042d7-0648-4ff7-97ce-34f42912b39b" alt=""></div>

We discovered two extra set of credentials. `Bankuser` and `banktest`.

## Defending

### Recommendations

* Implement a strong password policy:

{% content-ref url="/pages/WgMZMQE4cWeYS8XsSa9A" %}
[Strong Password Policy](/building-a-windows-ad-lab/defence/hardening/strong-password-policy.md)
{% endcontent-ref %}

### Detection

## References

{% embed url="<https://github.com/ropnop/kerbrute>" %}

{% embed url="<https://github.com/Greenwolf/Spray>" %}

{% embed url="<https://github.com/byt3bl33d3r/CrackMapExec>" %}

{% embed url="<https://github.com/dafthack/DomainPasswordSpray>" %}