Password Spraying
Password spraying is an effective technique for discovering weak passwords that users are notorious for using. Patterns such as MonthYear (August2019), SeasonYear (Summer2019) and DayDate (Tuesday6) are very common.
Be cautious of localisations, e.g. Autumn vs Fall.
Two excellent tools for password spraying against Office 365 and Exchange are MailSniper and SprayingToolkit. On the Attacker Desktop VM, open PowerShell and import MailSniper.ps1.
PS C:\Users\Attacker> ipmo C:\Tools\MailSniper\MailSniper.ps1You'll have to disable Defender's Real-time protection first.
Enumerate the NetBIOS name of the target domain with Invoke-DomainHarvestOWA.
PS C:\Users\Attacker> Invoke-DomainHarvestOWA -ExchHostname mail.cyberbotic.io
[*] Harvesting domain name from the server at mail.cyberbotic.io
The domain appears to be: CYBER or cyberbotic.io\
Next, we need to find valid usernames from the list of users enumerated from https://cyberbotic.io.
ubuntu@DESKTOP-3BSK7NO ~> cd /mnt/c/Users/Attacker/Desktop/
ubuntu@DESKTOP-3BSK7NO /m/c/U/A/Desktop> cat names.txt
Bob Farmer
Isabel Yates
John King
Joyce Adams\
namemash.py is a python script that I've used for as long as I can remember. It will take a person's full name and transform it into possible username permutations.
We could potentially skip this step if we knew the email address format from somewhere like hunter.io.
\
Invoke-UsernameHarvestOWA uses a timing attack to validate which (if any) of these usernames are valid.
\
MailSniper can spray passwords against the valid account(s) identified using, Outlook Web Access (OWA), Exchange Web Services (EWS) and Exchange ActiveSync (EAS).
\
OPSEC In the real world, be aware that these authentication attempts may count towards the domain lockout policy for the users. Too many attempts in a short space of time are not only loud but may also lock accounts out.
We can do further actions using MailSniper with valid credentials, such as downloading the global address list.
\
If there are names here that we didn't find during initial recon, we can go back and do another round of spraying against them.
\
Last updated