Greenwolf / Spray

A Password Spraying tool for Active Directory Credentials by Jacob Wilkin(Greenwolf)
GNU General Public License v3.0
723 stars 137 forks source link

Script does not work with usernames containing whitespace #13

Open daniel-cues opened 2 years ago

daniel-cues commented 2 years ago

The script uses

for u in $(cat $userslist); do 
    (echo -n "[*] user $u%$password " && rpcclient -U "$domain/$u%$password" -c "getusername;quit" $target) >> logs/spray-logs.txt
done

Without modifying IFS as so (this might be an improper fix though, as far as I'm concerned, the actual way to read lines in bash is with read, as in the password reading part of the script):

IFS=$'\n'
...
unset IFS

This translates into usernames with whitespace in them not being supported. the logs also use "cut -d ' ' ", that would also break with whitespace in the username

hackerlawyer commented 1 week ago

did this result in \r being placed after usernames in requests by chance? seeing that in wireshark and cant figure out why known valid logins are returning as false negatives

hackerlawyer commented 1 week ago

Nevermind found solution to my problem. Add a whitespace after each username or it will send a carriage return following the username (analyzed at packet level with wireshark) and cause logon failures even when password is accurate

hackerlawyer commented 1 week ago

it still sends a carriage return username as an attempted logon in following packet but does so seperately. As long as their isn't a username of r on the network it shouldnt cause any lockout issues