Spray365 是一款密码喷洒工具，用于识别 Microsoft 账户（Office 365 / Azure AD）的有效凭据。Spray365 与许多其他已有的密码喷洒工具有何不同？Spray365 允许从“执行计划”中喷洒密码。预先生成的执行计划可以提前描述喷洒操作，这不仅带来了 Spray365 所利用的许多其他好处，还允许在网络错误或其他中断后恢复密码喷洒（-R 选项）。虽然直接使用 Spray365 生成执行计划最为简便，但其他工具生成的兼容 JSON 结构也能轻松构建独特的密码喷洒工作流。
Spray365 提供了一些在喷洒凭据时实用的选项。可以使用随机用户代理来检测和绕过配置不当的条件访问策略（这些策略限制允许的设备类型）。同样，--shuffle_auth_order 参数是一种以更不可预测方式喷洒凭据的好方法。此选项旨在尝试绕过智能账户锁定（例如 Azure 智能锁定）。虽然并非完美，但随机化凭据尝试顺序还有其他好处，比如使检测这些喷洒操作更加困难。Spray365 还支持通过 HTTP/HTTPS 代理流量，这可以很好地与其他工具（如 Burp Suite）集成，用于操纵喷洒操作的来源。
克隆仓库，安装所需的 Python 包，然后运行 Spray365！
$ git clone https://github.com/MarkoH17/Spray365
$ cd Spray365
~/Spray365$ pip3 install -r requirements.txt -U
~/Spray365$ python3 spray365.py
喷洒凭据需要一个执行计划，因此我们需要创建一个！Spray365 可以通过在“普通”模式下运行生成命令来生成自己的执行计划：（spray365.py generate normal）。查看帮助（spray365.py generate -h / spray365.py generate normal -h）了解更多细节。
$ python3 spray365.py generate normal -ep <execution_plan_filename> -d <domain_name> -u <file_containing_usernames> -pf <file_containing_passwords>
例如：
$ python3 spray365.py generate normal -ep ex-plan.s365 -d example.com -u usernames -pf passwords
Spray365 还可以通过喷洒有效凭据来审计多因素认证（MFA）和条件访问策略配置。审计风格的执行计划会针对给定的凭据对，尝试所有 User-Agent + AAD Client ID + AAD Endpoint ID 的组合。
Spray365 可以通过在“审计”模式下运行生成命令来生成审计风格的执行计划：（spray365.py generate audit）。查看帮助（spray365.py generate -h / spray365.py generate audit -h）了解更多细节。虽然可以分别提供用户和密码列表（-u 和 -pf），但这些选项更适合用于密码喷洒（而非审计）的执行计划，这可能会导致大量无效登录尝试。相反，考虑使用 -u / --user_file 配合 --passwords_in_userfile，这将指示 Spray365 从“用户文件”中提取密码，方法是将输入文件的每一行按冒号分割，冒号前的值视为用户名，冒号后的值视为密码（例如 <username>:<password>，jsmith:Password01）。
$ python3 spray365.py generate audit -ep <execution_plan_filename> -d <domain_name> -u <file_containing_usernames_and_passwords> --passwords_in_userfile
例如：
$ python3 spray365.py generate audit -ep ex-plan.s365 -d example.com -u usernames --passwords_in_userfile
一旦创建了执行计划，就可以使用 Spray365 来处理它。在“spray”（spray365.py spray）模式下运行 Spray365 将处理指定的执行计划并喷洒相应的凭据。所有类型的执行计划（普通和审计）都可以在此模式下处理。查看帮助（spray365.py spray -h）了解更多细节。
$ python3 spray365.py spray -ep <execution_plan_filename>
例如：
$ python3 spray365.py spray -ep ex-plan.s365
从执行计划喷洒凭据后，Spray365 会输出一个包含结果的 JSON 文件。可以使用其他工具（如 JQ）处理此文件，以获取喷洒操作后的洞察。然而，Spray365 也包含一个“review”命令，可用于了解：
查看帮助（spray365.py review -h）了解更多细节。
$ python3 spray365.py review <spray_results_json_filename>
例如：
$ python3 spray365.py review spray365_results_2022-05-20_18-58-31.json
Usage: spray365.py generate normal [OPTIONS]
Generate a vanilla (normal) execution plan
Options:
-ep, --execution_plan File path where execution plan should be saved [required]
-d, --domain Office 365 domain to authenticate against [required]
--delay Delay in seconds to wait between authentication attempts [default: 30]
-mD, --min_loop_delay Minimum time to wait between authentication attempts for a given user. This option takes into account the time one spray iteration will take, so a pre-authentication delay may not occur every time [default: 0]
User options:
-u, --user_file File containing usernames to spray (one per line without domain) [required]
Password options: [mutually_exclusive, required]
-p, --password Password to spray
-pf, --password_file File containing passwords to spray (one per line)
--passwords_in_userfile Extract passwords from user_file (colon separated)
Authentication options:
-cID, --aad_client Client ID used during authentication. Leave unspecified for random selection, or provide a comma-separated string
-eID, --aad_endpoint Endpoint ID used during authentication. Leave unspecified for random selection, or provide a comma-separated string
User Agent options: [mutually_exclusive]
-cUA, --custom_user_agent Set custom user agent for authentication requests
-rUA, --random_user_agent Randomize user agent for authentication requests [default: True]
Shuffle options: [all_or_none]
-S, --shuffle_auth_order Shuffle order of authentication attempts so that each iteration (User1:Pass1, User2:Pass1, User3:Pass1) will be sprayed in a random order with a random arrangement of passwords, e.g (User4:Pass16, User13:Pass25, User19:Pass40). Be aware this option introduces the possibility that the time between consecutive authentication attempts for a given user may occur DELAY seconds apart. Consider using the-mD/--min_loop_delay option to enforce a minimum delay between authentication attempts for any given user.
-SO, --shuffle_optimization_attempts [default: 10]
-h, --help Show this message and exit.
Usage: spray365.py generate audit [OPTIONS]
Generate an execution plan to identify flaws in MFA / Conditional Access Policies. This works best with with known credentials.
Options:
-ep, --execution_plan File path where execution plan should be saved [required]
-d, --domain Office 365 domain to authenticate against [required]
--delay Delay in seconds to wait between authentication attempts [default: 30]
-mD, --min_loop_delay Minimum time to wait between authentication attempts for a given user. This option takes into account the time one spray iteration will take, so a pre-authentication delay may not occur every time [default: 0]
User options:
-u, --user_file File containing usernames to spray (one per line without domain) [required]
Password options: [mutually_exclusive, required]
-p, --password Password to spray
-pf, --password_file File containing passwords to spray (one per line)
--passwords_in_userfile Extract passwords from user_file (colon separated)
Shuffle options: [all_or_none]
-S, --shuffle_auth_order Shuffle order of authentication attempts so that each iteration (User1:Pass1, User2:Pass1, User3:Pass1) will be sprayed in a random order with a random arrangement of passwords, e.g (User4:Pass16, User13:Pass25, User19:Pass40). Be aware this option introduces the possibility that the time between consecutive authentication attempts for a given user may occur DELAY seconds apart. Consider using the-mD/--min_loop_delay option to enforce a minimum delay between authentication attempts for any given user.
-SO, --shuffle_optimization_attempts [default: 10]
-h, --help Show this message and exit.
Usage: spray365.py spray [OPTIONS]
Password spray user accounts using an existing execution plan
Options:
-ep, --execution_plan File path to execution plan [required]
-l, --lockout Number of account lockouts to observe before aborting spraying session (disable with 0) [default: 5]
-R, --resume_index Resume spraying passwords from this position in the execution plan [x>=1]
-i, --ignore_success Ignore successful authentication attempts for users and continue to spray credentials. Setting this flag will enable spraying credentials for users even if Spray365 has already identified valid credentials.
Proxy options: [all_or_none]
-x, --proxy HTTP Proxy URL (format: http[s]://proxy.address:port)
-k, --insecure Disable HTTPS certificate verification
-h, --help Show this message and exit.
Usage: spray365.py review [OPTIONS] RESULTS
View data from password spraying results to identify valid accounts and more
Options:
--show_invalid_creds
--show_invalid_users
-h, --help Show this message and exit.
| 作者 | 工具/其他 | 链接 |
|---|---|---|
| @__TexasRanger | msspray：针对 Azure AD 进行密码喷洒攻击，并验证 Azure 和 Office 365 端点上 MFA 的实现 | https://github.com/SecurityRiskAdvisors/msspray |
在未事先获得双方同意的情况下使用此软件攻击目标是违法的。最终用户有责任遵守所有适用的地方、州和联邦法律，以及任何适用的可接受使用政策。使用此软件意味着作者对任何滥用或造成的损害不承担任何责任。