Ehxb | Password Spraying Attacks on AD

Internal Password Spraying using Linux

After building a valid username list, the next step is executing the password spraying attack. This stage is critical because it is one of the primary ways to obtain valid domain credentials, but it must be performed carefully to avoid account lockouts or detection.

Internal Password Spraying from Linux

Once a username list is prepared, Linux-based tools can be used to attempt authentication against Active Directory using a single password across multiple accounts. One common approach is using rpcclient in a loop. A successful authentication is not always obvious, but a valid login typically returns an “Authority Name” response. This can be filtered to show only successful attempts.

Example Bash one-liner:

bash
 
1for u in $(cat valid_users.txt); do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done

Example output:

plaintext
 
1Account Name: tjohnson, Authority Name: INLANEFREIGHT
2Account Name: sgage, Authority Name: INLANEFREIGHT

This indicates successful authentication for those users.

Using Kerbrute for Password

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.