Top tools for password-spraying attacks in active directory networks
Password guessing is essentially an art form when this attack is performed on a large scale against a large group of users. Password spraying attacks are part of this landscape, and they can be carried out in different situations, including active directory networks. In short, this attack attempts to authenticate into many user accounts using the same password. Because of this, corporate networks are often targeted, as obtaining usernames from a company can be an easy task these days with the help of OSINT techniques simply by using social networks such as LinkedIn or Facebook.
According to Microsoft, the three steps to conduct a password-spraying attack are:
- Acquire a list of usernames: starting with a list of names: firstname.lastname@example.org
- Spray passwords: testing popular and common passwords (123456, password, and Winter21!). See the top 10,000 passwords. )
- Gain access: one of the tested attempts works, and the account can be abused to enumerate assets in the AD network, exploit authenticated services and put the organization at risk.
Figure 1: Workflow where the password “Summer2016” was spread against an Active Directory network. The user “Glen” was a match, and privileged access over the corporate network was obtained.
Popular tools for password spraying attacks
MSOLSpray is a password spraying tool used against Microsoft Online accounts (Azure/O365). In detail, the script logs if a user cred is valid, the MFA mechanism is enabled, if the user account doesn’t exist, is locked, or is disabled.
This tool can be used with the following commands:
Ruler is a tool used to interact with Exchange servers. The main goal of the ruler is to abuse the client-side Outlook features, including performing password-guessing attacks and gaining remote privileges.
CrackMapExec, also called CME, is a tool that helps to automate the security of large Active Directory networks. To perform password spraying attacks with CME, we can use the next command:
Other CME commands can be seen here.
Kerbrute is a tool created to guess and enumerate Active Directory accounts through Kerberos Pre-Authentication.
Kerbrute can be executed using the following commands:
Talon is a tool created to execute password guessing attacks while remaining undetected. Talon can use a single domain controller or multiple ones to perform these guessing attacks, randomizing each attempt between the domain controllers and services (LDAP or Kerberos).
Talon can be used with the following command:
DomainPasswordSpray is a tool developed in PowerShell to perform a password spray attack. By default, it will automatically generate the user list from the domain.
Command to execute the script:
This is a collection of tools to enumerate and attack self-hosted Skype for Business and Microsoft Lync installations.
The tool can be executed with the following commands:
Password spraying attacks are often the first test conducted to verify the security of a corporate network. As it is easy to obtain valid usernames from a target corporation, criminals have abused this attack to get an initial foothold over internal networks. Because of this, active defense is needed, ensuring that weak and popular passwords are not used by employees to put at risk the internal servers.
On the other hand, setting account lockout policies after some failed attempts is also a good measure to mitigate the risks. Implementing a CAPTCHA mechanism and the usage of multi-factor authentication can also limit the possibility of a well-succeeded attack.
- Protecting your organization against password spray attacks, Microsoft
- Password Spraying, GitBook – Segurança-Informática
- Password Spraying Attack, OWASP