Password Spraying - Making a Target User List
There are several ways that we can gather a target list of valid users:
By leveraging an SMB NULL session to retrieve a complete list of domain users from the domain controller
Utilizing an LDAP anonymous bind to query LDAP anonymously and pull down the domain user list
Using a tool such as Kerbrute to validate users utilizing a word list from a source such as the stastically-likely-usernames GitHub repo, or gathered by using a tool such as linkedin2username to create a list of potentially valid users
Using a set of credentials from a Linux or Windows attack system either provided by our client or obtained through another means such as LLMNR/NBT-NS response poisoning using Responder or even a successful password spray using a smaller wordlist
Enum4Linux
enum4linux -U 172.16.5.5 | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"
administrator
guest
krbtgt
lab_adm
htb-student
avazquez
pfalcon
fanthony
wdillard
lbradford
sgage
asanchez
dbranch
ccruz
njohnson
mholliday
<SNIP>Using RpcClient
CrackMapExec
Gathering Users with LDAP Anonymous
Tools such as windapsearch make this easier (though we should still understand how to create our own LDAP search filters). Here we can specify anonymous access by providing a blank username with the -u flag and the -U flag to tell the tool to retrieve just users.
Using windapsearch
Kerbrute User Enumeration
Credentialed Enumeration to Build our User List
With valid credentials, we can use any of the tools stated previously to build a user list. A quick and easy way is using CrackMapExec.
Using CrackMapExec with Valid Credentials
Using Kerbrute we found an ASREPROASTABLE account!
Last updated