🧠Active Directory - Password Spraying
What is it?
- Concept: Trying one (or a small number of) likely password against every known account, instead of many passwords against one account — keeps each individual account’s failed-attempt count low enough to dodge lockout policies, which are almost always keyed on a per-account attempt counter.
- Impact: Initial foothold via a single account that never changed a leaked, default, or seasonally-guessable password.
How it works
Account lockout policies exist to stop credential stuffing/brute forcing one account, so they reset (or never trigger) as long as no single account sees more than a couple of failed attempts. Spraying flips the usual brute-force axis: instead of many passwords against one user, it’s one password against many users, so the whole domain’s user list can be tried without ever tripping a lockout on any individual account. It only takes one account somewhere in a large org that reused, never rotated, or was never told to change a default/leaked password.
Exploitation
Prerequisites
- A list of valid domain usernames — via a null/Guest SMB session, LDAP, or Active Directory - RID Cycling if direct enumeration is blocked
- A candidate password (leaked default, company/season name, a value pulled from a document/description field, etc.)
Attack Vectors
nxc smb <target> -u usernames.txt -p '<candidate_password>' --continue-on-successNotes
- Keep spraying attempts spaced out and limited to one or two passwords per run — hammering every account with many candidate passwords back-to-back defeats the entire point (staying under the lockout threshold).
- A hit is often just the start of the chain rather than the end of it — re-run enumeration (users, shares, groups) as the newly-compromised account, since access frequently differs per account.
Mitigation
- Fix: Enforce unique, expiring default passwords on account creation, and monitor authentication logs for the spray pattern itself (many distinct accounts, one password, tight time window) rather than relying on lockout thresholds alone.
Related Usage
| File | Created |
|---|---|
| HTB - Cicada | Tuesday, July 21st 2026, 2:55:20 am |
References: