---
description: >-
  People don't always choose strong passwords, neither do IT people for
  temporary accounts. Spraying passwords against all found user accounts is
  effective for getting access to the domain.
---

# Password Spraying

## Configuring

### Prerequisite&#x20;

{% content-ref url="" %}
[]()
{% endcontent-ref %}

### Configuring

1. To implement the attack we need to set a weak password for some of the users we created and enumerated in the previous step. The easiest way is by using the `net user` command in the terminal. To change the password for `john` to `Welcome2022!` and `chris` to `Summer2022!` execute the following commands on `DC02`:

```
net user john Welcome2022! /domain
net user chris Summer2022! /domain
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FVcCyXpO61wrasQ7YA4oH%2Fimage.png?alt=media&#x26;token=ad3cea11-c8c5-485f-bd5d-4b421b3526de" alt=""></div>

## Attacking

### How it works

Password spraying is a type of brute force attack. An attacker will try a default password against a list of usernames. For example, an attacker uses the password `Welcome2022!` against many different accounts to avoid account lockout that would normally occur when brute-forcing a single account with many passwords.

A old habit what a lot of companies enforce is the requirement to change passwords every 30, 60 or 90 days. Which results in people changing their password often, forgetting it and eventually choosing a easy guessable password. Another habbit is adding a increment to the same password or using months/seasons. Which means we can easily create a password list of common passwords and things people would choose using following formats:

* season+year+! (Summer2022!)
* month+year+! (March2022!)
* companyname+year+! (Amsterdambank2022!)
* city+! (Amsterdam!)
* etc.

### Tools

* [Kerbrute](https://github.com/ropnop/kerbrute)
* [Spray](https://github.com/Greenwolf/Spray)
* [Crackmapexec](https://github.com/byt3bl33d3r/CrackMapExec)
* [Domainpasswordspray](https://github.com/dafthack/DomainPasswordSpray)
* [Rubeus](https://github.com/GhostPack/Rubeus)

### Executing the attack

#### Spraying a single password

To spray a single password from our kali machine we will use kerbrute again. But this time we will use the passwordspray functionality. We will spray the password `Welcome2022!` against all the users we enumerated earlier.

```
./kerbrute_linux_amd64 passwordspray -d amsterdam.bank.local --dc 10.0.0.3 ~/adlab/users.txt 'Welcome2022!'
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FRl9poWKl4ZjHePYxf06A%2Fimage.png?alt=media\&token=a4ff848d-8d5a-4b70-ab3e-e2d195ad1b69)

{% hint style="warning" %}
It is recommended to not spray more then one password every 30 minutes to prevent locking out accounts. We don't have access to the domain yet and can't retrieve the current passwordpolicy.
{% endhint %}

#### Spraying a small list of passwords

1. To spray a list of passwords we can use Spray. First create a `passwords.txt` file and copy the following passwords:

```
Spring2022!
Winter2022!
Autumn2022!
Summer2022!
Welcome2022!
Bank2022!
AmsterdamBank2022!
```

2\. Since we don't want to lock any accounts we will try one password every 31 minutes by using the following command:

```
bash spray.sh smb 10.0.0.3 ~/adlab/users.txt ~/adlab/passwords.txt 1 31 passwordspray.txt
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2Fnu9iMl2rLLM7phDJtRGb%2Fimage.png?alt=media&#x26;token=3e083f06-c061-4ef2-bada-feaebd521606" alt=""></div>

{% hint style="info" %}
For demonstration purposed we used 1 minute in the screenshot.
{% endhint %}

## Defending

### Recommendations

* Implement a strong password policy:

{% content-ref url="../../../defence/hardening/strong-password-policy" %}
[strong-password-policy](../../../defence/hardening/strong-password-policy)
{% endcontent-ref %}

### Detection



## References

{% embed url="https://github.com/ropnop/kerbrute" %}

{% embed url="https://github.com/Greenwolf/Spray" %}

{% embed url="https://github.com/byt3bl33d3r/CrackMapExec" %}

{% embed url="https://github.com/dafthack/DomainPasswordSpray" %}

