Password Spraying
Is an attack that uses a single or small list of passwords against many different accounts to attempt to acquire valid account credentials.
Exploitation
We have got a valid credential of user saifullah, we will try to enumerate users from the domain and then execute password spray attack against the users using the password of saifullah.
Let’s enumerate users with crackmapexec.
1
2
3
crackmapexec smb [ip] -u saifullah -p sPassword@123 --users
Since we have got the list of users, we will execute password spray attack against them with the password of saifullah sPassword@123 as the password.
As you can see, we got three accounts using thesame passwords.