In this video, I'm gonna run through the password spraying exercise.
From our external reconnaissance,
we have their public facing exchange server
at mail dot cyberbotics dot io,
and we also have a list of names.
So the first thing to do is to transform this list of names
into a list of potential usernames.
Now to achieve that, there's a script under
WSL.
Oops.
Called name mash.
And if we look at the code,
it simply,
splits the list and then does some transformation to print
out a bunch of different combinations.
Now the advantage of doing this inside WSL running on the
Windows ten VM is that it can share files.
So we don't have to worry about
copying a file across to, like, Linux, doing some with it,
and then copying it back.
We can do CD mount c
users attacker
desktop, and names dot txt is there.
Okay. So this is just the same file.
So then we can do,
name mash, and then just give it that file name.
And we can see all the results here.
So So let's do that again, but this time, pipe it to or output
the, results to another text file.
So I'll just call it, possible dot txt.
Txt.
And you can see now we have a new text text file on the desktop.
So now I'm gonna open a PowerShell window.
And, first things first, we have to,
just disable
Defender real
real quick, because we want to import
mail sniper.
Which, defender doesn't like.
Let's make this a bit wider.
So what we can do next is use a timing attack to work
out which, if any,
of these usernames are actually valid on the,
on the Exchange server.
And to do that, we can use a cmdlet from Mail Sniper
called, invoke username
harvest.
And you can do this against, EES, Gmail, or EWA,
which is what we're gonna use here.
It needs the exchange host name, which, of course,
is just mail dot cyberbiotic dot I o,
The, domain name, which is also just cyberbotik dot I o.
Next, it wants a user list.
So this would be
the, not the names, the possible,
text file.
And we will output valid results to,
valid dot t x d.
You can see that it attempts to establish a baseline response
time using nonsense usernames.
So these are in the seven hundred and something
millisecond range, seven hundreds, eight hundreds.
And then you can see that this valid result we got here,
the response time was a hundred and forty three.
So you can see, here we go, fifty seven.
So invalid usernames take a lot longer to come back,
and valid ones, they come back a lot faster.
So forty eight milliseconds.
So off that list, we have three potential valid usernames.
And they are b farmer, r yates, and j king.
So now that we have these, we can
attempt to guess their passwords.
And to do that, we can use invoke
password spray,
which is also for MailSniper.
The
the user list which
is valid dot txt
and the password.
Now a lot of people ask, well,
how do you give this a password list?
And that's really not the purpose of the tool.
The purpose of the tool is to make manual password guesses
based on known bad habits.
So
for example,
season, year, month, year,
days, the company name, and things
like that, especially in large organizations.
And if you have a very long, valid list of users,
the chances are pretty high that you're gonna find someone
who is using a weak password like this.
So let's give this a
go.
Okay. And we got one result.
So
this user, I Yates,
has the password of summit twenty twenty two.
And we can use this to log in.
So we can say I yates
at cyberbotics dot I o and then summer twenty twenty two.
Okay.
If they've never logged in to EWA before, you'll see this,
set up for their preferred language.
So I'm just gonna do this for where I am, which is in the
UK. So I will select, London.
And we now have access to this user's inbox.
All of their sent mail and, and things like that.