Skip to content
Pwnversity

Password Spraying

Password spraying inverts classic brute force: instead of trying many passwords against one user (which locks the account), it tries one plausible password against many users. Since lockout policies count attempts per account, one attempt per user every so often stays under the threshold. In a domain with hundreds of employees, it’s enough for one person to use Company2025! or Summer2025 to get a foothold.

Threat model

Section titled “Threat model”

The attacker exploits human statistics: in any large organization, someone uses a weak password that meets the complexity policy (Name+year+symbol). Since they only need one valid one and spraying avoids lockout, the cost is tiny and the noise moderate. It requires a user list (from Active Directory Enumeration) and knowing the lockout policy so as not to overshoot.

Prerequisites

Section titled “Prerequisites”
  • Valid user list (Kerberos userenum, enum4linux, OSINT of names).
  • Lockout policy (net accounts, nxc ... --pass-pol): attempt threshold and observation window → defines how many attempts and with what spacing.

Red Team

Section titled “Red Team”

Build the candidates

Section titled “Build the candidates”

Passwords that meet complexity but are guessable:

Season/month + year + symbol:  Summer2025!  Autumn2025!  January2025!
Company + year:                Acme2025!  Acme1234
Common base:                   Password1  Welcome1  Changeme123
Keyboard patterns:             Qwerty123!  Zaq12wsx

Also: the username as password, and passwords from description fields found in enum.

Launch the spray (controlling lockout)

Section titled “Launch the spray (controlling lockout)”
# NetExec against SMB (respects the threshold: 1 attempt/user per round)
nxc smb <DC> -u users.txt -p 'Summer2025!' --continue-on-success
# Kerberos pre-auth (stealthier, generates no SMB 4625)
kerbrute passwordspray -d domain.local --dc <DC> users.txt 'Summer2025!'
# LDAP/WinRM/MSSQL also valid as surface
nxc ldap <DC> -u users.txt -p 'Summer2025!'

Golden rule: one attempt per account per round, and wait for the lockout observation window to pass before trying the next password. Better a few very likely passwords than many.

Special sprays

Section titled “Special sprays”
  • AS-REP roasting as a spray: if there are accounts without preauth, you get hashes without trying passwords (Kerberos Attacks).
  • Spray against external services: OWA/Exchange, VPN, ADFS, O365 portals (MFA can stop it, but doesn’t always cover everything).
  • Reuse: a password cracked from Responder/NTLM tried against everyone (internal credential stuffing).

After a hit

Section titled “After a hit”

A single [+] yields domain credentials → jump to full enumeration (Active Directory Enumeration/BloodHound), more spraying with that password on other services, and finding where that account is local admin.

Tools

Section titled “Tools”
  • NetExec (nxc) — multi-protocol spray (SMB/LDAP/WinRM/MSSQL/RDP) with lockout control.
  • kerbrute — Kerberos pre-auth spray (fast and stealthier).
  • DomainPasswordSpray (PowerShell, from inside the domain, auto-discovers users and policy).
  • MailSniper — spray against external OWA/Exchange.

Impact

Section titled “Impact”

Initial or lateral access with valid domain credentials, often starting from just a list of names. It’s one of the most common entry vectors into AD and the start of countless real intrusions.

Blue Team

Section titled “Blue Team”

Detection

Section titled “Detection”
  • Many 4625 (logon failures) from one password against many accounts in a short window → classic spray signature.
  • Kerberos: many 4768/4771 with failed pre-auth from one source.
  • Successful logins (4624) from an unusual IP/source after a burst of failures; spikes in OWA/VPN/ADFS.

Telemetry

Section titled “Telemetry”

Correlate 4625/4771 by password/source rather than by account (spray dilutes if you look per account only). SIEM with “N distinct accounts, same source, same window” rules. Watch Exchange/VPN/ADFS logs.

Hardening

Section titled “Hardening”
  • MFA on everything exposed (VPN, OWA, portals) — the highest-impact mitigation.
  • Strong passwords and banning common patterns: Azure AD Password Protection / banned-password lists block Company2025!.
  • Smart lockout and well-tuned lockout policies; alerts at the threshold.
  • Reduce the exposed authentication surface; disable legacy protocols (IMAP/POP/SMTP basic auth) that bypass MFA.
  • High minimum length (passphrases), sensible rotation, and reuse detection.

Response

Section titled “Response”

Reset the compromised accounts, enforce MFA, investigate what the account reached (sessions, access), and hunt for lateral spraying with the same password on other systems.

CVEs and real-world cases

Section titled “CVEs and real-world cases”
  • Password spraying isn’t a CVE: it’s a TTP (MITRE T1110.003), among the most used for initial access.
  • APT: Midnight Blizzard / Nobelium (2024) compromised Microsoft via password spraying against a legacy account without MFA — a recent reference case.
  • APT33, Lazarus, numerous groups use spraying against O365/VPN as a documented entry.
  • Countless ransomware intrusions start with a spray against exposed RDP/VPN.

Testing checklist

Section titled “Testing checklist”
  • Do you have a valid user list and the lockout policy?
  • Candidates meeting complexity (season+year, company+year)
  • One attempt/account per round, respecting the lockout window
  • Spray via Kerberos (stealthy) and via SMB/LDAP
  • Username = password; passwords from descriptions
  • Spray against external services (OWA/VPN/ADFS) — MFA?
  • Reuse of a cracked password against everyone
  • Blue: detection by source/password and MFA deployed?

References

Section titled “References”