/password-spraying

name: password-spraying
description: >
  Performs password spraying against authentication services with lockout-safe
  techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA,
  and any service with username/password auth. Service-agnostic — the
  orchestrator passes target services and spray intensity tier.
keywords:
  - password spray
  - spray passwords
  - domain spray
  - brute force domain
  - find valid credentials
  - lockout policy
  - kerbrute spray
  - credential guessing
  - smb spray
  - winrm spray
  - ssh spray
  - mssql spray
  - mysql spray
  - web login spray
  - hydra
  - nxc spray
tools:
  - kerbrute
  - netexec
  - hydra
  - SpearSpray
  - DomainPasswordSpray
  - spray.sh
opsec: high

Password Spraying

You are helping a penetration tester perform password spraying against authentication services. All testing is under explicit written authorization.

**OPSEC Exception**: This skill tests credentials directly against the domain. The Kerberos-first authentication convention does not apply here — spraying IS the authentication attempt. However, Kerberos pre-auth spraying (kerbrute, SpearSpray) is preferred over NTLM spraying because it generates Event 4771 instead of 4625, which is less commonly monitored.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[password-spraying] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Username list (from RID cycling, kerbrute, LDAP, or BloodHound)
• Network access to DC (port 88 for Kerberos, 445 for SMB, 389 for LDAP)
• Tools: `kerbrute`, `netexec` (nxc), optionally `SpearSpray`,

`DomainPasswordSpray`, `spray.sh`

**WARNING**: Always enumerate password policy before spraying. Spraying without knowing the lockout threshold risks locking out accounts.

Step 1: Enumerate Password Policy

From Linux (Unauthenticated)

**Primary — LDAP anonymous query** (most reliable, returns structured data):

# Query lockout + password attributes from domain root object
ldapsearch -x -H ldap://DC01.DOMAIN.LOCAL -b "DC=DOMAIN,DC=LOCAL" -s base \
  '(objectClass=*)' lockoutThreshold lockOutObservationWindow \
  lockoutDuration minPwdLength pwdProperties

Returns integer values directly:

• `lockoutThreshold: 0` = no lockout (spray freely)
• `lockoutThreshold: 5` = 5 attempts before lockout
• Duration/window values are negative 100ns intervals — divide abs(value) by

600,000,000 to get minutes (e.g., `-18000000000` = 30 minutes)

Requires anonymous LDAP bind (common on misconfigured DCs).

**Secondary — NetExec SAMR query** (human-readable output):

nxc smb DC01.DOMAIN.LOCAL -u '' -p '' --pass-pol
nxc smb DC01.DOMAIN.LOCAL -u 'guest' -p '' --pass-pol

Look for "Account Lockout Threshold" in the output. "None" = 0 = no lockout.

**Tertiary — enum4linux-ng** (modern Python rewrite of enum4linux):

enum4linux-ng -P DC01.DOMAIN.LOCAL

**Note on rpcclient:** `rpcclient -c "getdompwinfo"` returns min password length and password properties only — it does NOT return lockout threshold, observation window, or lockout duration. Do not rely on it for lockout policy.

From Linux (Authenticated)

# NetExec with valid creds
nxc smb DC01.DOMAIN.LOCAL -u 'user' -p 'Password123' --pass-pol

# With Kerberos
nxc smb DC01.DOMAIN.LOCAL --use-kcache --pass-pol

From Windows

# Built-in
net accounts /domain

# PowerView
(Get-DomainPolicy)."SystemAccess"

Key Values to Record

| Policy Setting | What to Record | |---------------|----------------| | Lockout threshold | Max failed attempts before lockout (0 = no lockout) | | Observation window | Time window for counting failures (minutes) | | Lockout duration | How long accounts stay locked (minutes) | | Min password length | Informs password list generation | | Complexity requirements | Whether special chars/numbers are required | | Password history | Number of previous passwords remembered |

**Critical**: If lockout threshold is 0, there is no lockout — spray freely. If threshold is low (1-3), extreme caution is needed.

Fine-Grained Password Policies (PSOs)

Different groups may have different lockout thresholds. SpearSpray handles this automatically. To check manually:

# bloodyAD
bloodyAD -u user -p 'Password123' -d DOMAIN.LOCAL --host DC_IP \
  get search --filter '(objectClass=msDS-PasswordSettings)' \
  --attr cn,msDS-LockoutThreshold,msDS-LockoutObservationWindow

# PowerView
Get-DomainFineGrainedPasswordPolicy

Step 2: Verify Usernames

The orchestrator passes usernames in the agent prompt. Write them to `engagement/evidence/usernames.txt` as described in the File-Based Spray Model section above.

If the orchestrator did NOT provide usernames and you need to enumerate:

# RID cycling (unauthenticated)
nxc smb DC01.DOMAIN.LOCAL -u 'guest' -p '' --rid-brute 10000 \
  | awk -F'\\\\| ' '/SidTypeUser/ {print $3}' > engagement/evidence/usernames.txt

# kerbrute user enumeration (Kerberos — stealthier, generates 4771)
kerbrute userenum -d DOMAIN.LOCAL --dc DC01.DOMAIN.LOCAL \