Spray: Password Spraying tool for Active Directory Credentials
Spray
A Password Spraying tool for Active Directory Credentials by Jacob Wilkin(Greenwolf)
Install
Requirement
All requirements come preinstalled on Kali Linux, to run on other flavors or Mac just make sure curl(owa & Lync) and rpcclient(smb) are installed using apt-get or brew.
Download
git clone https://github.com/Greenwolf/Spray.git
Use
This script will password spray a target over a period of time It requires password policy as input so accounts are not locked out
Accompanying this script is a series of handcrafted password files for multiple languages. These have been crafted from the most common active directory passwords in various languages and all fit in the complex (1 Upper, 1 lower, 1 digit) category.
SMB
To password spray an SMB Portal, a userlist, password list, attempts per lockout period, lockout period length and the domain must be provided
Useage: spray.sh -smb <targetIP> <usernameList> <passwordList> <AttemptsPerLockoutPeriod> <LockoutPeriodInMinutes> <DOMAIN>
Example: spray.sh -smb 192.168.0.1 users.txt passwords.txt 1 35 SPIDERLABS
OWA
To password spray an OWA portal, a file must be created of the POST request with the Username: sprayuser@domain.com, and Password: spraypassword
Useage: spray.sh -owa <targetIP> <usernameList> <passwordList> <AttemptsPerLockoutPeriod> <LockoutPeriodInMinutes> <RequestsFile>
Example: spray.sh -owa 192.168.0.1 users.txt passwords.txt 1 35 post-request.txt
Lync
To password spray a Lync service, a Lync autodiscover url or a url that returns the www-authenticate header must be provided along with a list of email addresses
Useage: spray.sh -lync <targetIP> <usernameList> <passwordList> <AttemptsPerLockoutPeriod> <LockoutPeriodInMinutes>
Example: spray.sh -lync https://lyncdiscover.spiderlabs.com/ users.txt passwords.txt 1 35
Example: spray.sh -lync https://lyncweb.spiderlabs.com/Autodiscover/AutodiscoverService.svc/root/oauth/user users.txt passwords.txt 1 35
CISCO Web VPN
To password spray a CISCO Web VPN service, a target portal or server hosting a portal must be provided
Useage: spray.sh -cisco <targetURL> <usernameList> <passwordList> <AttemptsPerLockoutPeriod> <LockoutPeriodInMinutes>
Example: spray.sh -ciso 192.168.0.1 usernames.txt passwords.txt 1 35
Password List Update
It is also possible to update the supplied 2016/2017 password list to the current year
Useage: spray.sh -passupdate <passwordList>
Example: spray.sh -passupdate passwords.txt
An optional company name can also be provided to add to the list
Useage: spray.sh -passupdate <passwordList> <CompanyName>
Example: spray.sh -passupdate passwords.txt Spiderlabs
Username generation
A username list can also be generated from a list of common names
Useage: spray.sh -genusers <firstnames> <lastnames> “<<fi><li><fn><ln>>”
Example: spray.sh -genusers english-first-1000.txt english-last-1000.txt “<fi><ln>”
Example: spray.sh -genusers english-first-1000.txt english-last-1000.txt “<fn>.<ln>”
Spray Created by Jacob Wilkin Copyright (C) 2017 Trustwave Holdings, Inc.
Source: https://github.com/Greenwolf/
