SharpSpray：一款功能强大的活动目录密码喷射安全工具

git clone https://github.com/iomoath/SharpSpray.git

> SharpSpray.exe --help

 

  -v, --Verbose       Show verbose messages.

  -u                  (Optional) Username list file path. This will be

                      automatically fetched from the active directory if not specified.

  -p                  A single password that will be used to perform the password spray.

  -k, --pl            (Optional) Password List file path.

  -d                  (Optional) Specify a domain name.

  -m                  Use this option if spraying from a host located outside the Domain context.

  -q, --dc-ip         Required when the option 'm' OutsideDomain is checked

  -x                  Attempts to exclude disabled accounts

                      from the user list (Not supported with the option -m)

  -z                  Exclude accounts within 1 attempt of

                      locking out (Not supported with the option -m)

  -f                  Custom LDAP filter for users, e.g. "(description=*admin*)"

  -o                  A file to output the results to.

  -w                  Do not relay on domain lockout observation window settings and use this specific value. (Default 32 minute)

  -s                  (Optional) Delay in seconds between each authentication attempt.

  -j                  (Optional) Jitter in seconds.

  --Force             Force start without asking for confirmation.

  --get-users-list    Get the domain users list from the active directory.

  --show-examples     Get domain users list from the active directory.

  --show-args         Show command line args

  --help              Display this help screen.

-v, --Verbose       显示Verbose信息

  -u                （可选）用户名列表文件路径，如果不指定，则自动从活动目录获取

  -p                用于执行密码喷射的单个密码

  -k, --pl            （可选）密码列表文件路径

  -d               （可选）指定目标域名

  -m              如果目标主机位于域上下文之外的位置，则可以使用该选项

  -q, --dc-ip         检测’m’参数时要求使用该选项

  -x                尝试从用户列表中排除已禁用的账号

  -z                 通过在一次锁定尝试中排除帐户，避免潜在的帐户锁定

  -f                 自定义LDAP过滤器，例如"(description=*admin*)"

  -o                 存储处理结果的文件

  -s                  （可选）每次身份验证尝试之间的延迟（秒）

  -j                  （可选）以秒为单位的抖动

  --Force              强制执行任务，无需进行确认

  --get-users-list        从活动目录获取域用户列表

  --show-examples      从活动目录获取域用户列表

  --show-args          显示命令行参数

  --help              显示帮助信息

SharpSpray.exe -v -x -z --pl password.txt

SharpSpray.exe -x -z -u users.txt --pl psswd.txt

SharpSpray.exe -x -z -u users.txt -p Passw0rd!

SharpSpray.exe -x -z -s 3 -j 1 -u users.txt -k psswd.txt -o sprayed.txt

SharpSpray.exe -w 32 -m -d DC-1.local --dc-ip 10.10.20.20 -u users.txt --pl psswd.txt

SharpSpray.exe -w 32 -s 3 -j 1 -m -d DC-1.local --dc-ip 10.10.20.20 -u users.txt --pl psswd.txt

样例3

SharpSpray.exe --get-users-list

SharpSpray.exe --get-users-list > users.txt

PS> .\SharpSpray.exe --get-users-list | Out-File -Encoding ascii users.txt

如何从活动目录中仅获取用户列表

SharpSpray.exe -x -z --get-users-list


-x: Exclude disabled accounts from the user list.

-z: Exclude accounts within 1 attempt of locking out.
参数介绍

 -x: 从用户列表中排除已禁用的账号

 -z: 一次尝试锁定后排除目标账号