Credential Spraying
How to find and use internal credentials.
Valid Credential Spraying
When at least one valid username and password combination has been identified, valid credential spraying can be used to find where the account can login and find any escalated privileges.
NetExec can be used to perform the password spray, where the valid credentials are used across a subnet of workstations to validate if the user can login and if they have any escalated privileges:
nxc smb <target_ip/range> -d <domain> -u <username> -p <password>
Known Password Spraying
When a valid password has been identified or you have made an educated guess, you may want to spray the password against a range of accounts to find any successful credential combinations.
NetExec can be used to perform the spray, where the password is used across a list of users to validate if the user and password combination is valid:
nxc smb <target_ip> -d <domain> -u <users.txt> -p <password>
Last updated