Password Spraying: One Password, Every Account

The opposite of brute force

Brute forcing hammers one account with thousands of passwords until it breaks. That triggers the account-lockout threshold in minutes and is exactly what defenders watch for. Password spraying inverts it: take one common password and try it against every account in the domain, once each. Nobody locks out, and one reused password is all it takes.

The entire technique hinges on knowing the lockout policy first. nxc --pass-pol reads it straight off the DC:

$ nxc smb 192.168.56.11 -u samwell.tarly -p Heartsbane --pass-pol
SMB  192.168.56.11  445  WINTERFELL  Account Lockout Threshold: 5
SMB  192.168.56.11  445  WINTERFELL  Password Complexity Flags: 000000

Two numbers matter. The threshold is 5, so you can safely attempt 4 logins per account before it locks — and because you only try each account once per password, that is never a risk in a spray. The complexity flags are 000000 (complexity off), which tells you that weak, predictable passwords are actually allowed in this domain. That is the green light for a spray.

The spray itself

The direction is what makes it safe: a password list of one, a user list of many. nxc walks the users and stops only if you tell it not to (--continue-on-success, so a hit does not halt the run):

$ nxc smb 192.168.56.11 -u users.txt -p "Password1" --continue-on-success
SMB  192.168.56.11  445  WINTERFELL  [-] arya.stark:Password1 STATUS_LOGON_FAILURE
SMB  192.168.56.11  445  WINTERFELL  [-] eddard.stark:Password1 STATUS_LOGON_FAILURE
... (all twelve fail) ...

$ nxc smb 192.168.56.11 -u users.txt -p "Winter2022" --continue-on-success
SMB  192.168.56.11  445  WINTERFELL  [+] north.sevenkingdoms.local\rickon.stark:Winter2022

The first spray (Password1) washes out cleanly — a normal result. The second (Winter2022) finds one account reusing a seasonal password. That single [+] is a foothold: the same password that just failed on eleven accounts worked on one, and now we have a valid domain login without ever tripping the 5-attempt threshold.

The choice of password is the skill. Real sprays use the seasonal and org-specific guesses that ordinary users reach for — Summer2024!, CompanyName1, Welcome123 — because complexity being off means those guesses live in the domain. A list of a dozen such passwords across a few hundred users is usually enough for one hit, and it generates almost no lockout traffic.

Detection and the fix

Detection: A spray looks like a burst of 4625 (failed logon) events for different usernames from a single source in a short window — the opposite of a brute force, which is many failures for one username. Watch for many 4625s with distinct TargetUserName values from one IP; that is the spray signature.

Control: Enforce password complexity (this domain had it off), block common/seasonal passwords with a banned-password list, and require MFA so a guessed password is not enough. On the monitoring side, alert on N failed logons across distinct usernames from one source, not just per-account.

Summary

Evidence and limits

The password policy query (--pass-pol) and single-candidate spray (Hod0r!, Winter2022!) were executed against WINTERFELL (192.168.56.11) inside the isolated GOAD lab. All accounts and passwords belong to GOAD’s synthetic north.sevenkingdoms.local directory.

References

• Orange Cyberdefense, GOAD: orange-cyberdefense.github.io/GOAD
• The Hacker Recipes, Password Spraying: thehacker.recipes/ad/movement/credentials/bruteforcing/spraying
• HackTricks, Password Spraying: book.hacktricks.xyz
• NetExec documentation: netexec.wiki
• MITRE ATT&CK, Password Spraying (T1110.003): attack.mitre.org/techniques/T1110/003