Active Directory Password Spraying: A Lab Demonstration

Summary

The video demonstrates Active Directory password spraying in a lab using NetExec, PowerShell and Python, covering account discovery, password-policy risks and lockout coordination. The presenter also describes an Iran-related operation but provides no verification.

Key points

• The presenter describes a March 2026 password-spraying operation against exposed Kali infrastructure, claiming it sought account access and intelligence before military strikes; the transcript provides no evidence or attribution details.
• The demonstration uses an intentionally vulnerable Active Directory lab and reports successful password guesses, including usernames reused as passwords and a common weak password.
• The video shows user discovery through LDAP and describes spraying against protocols including LDAP and SMB.
• NetExec, PowerShell and Python are presented as ways to conduct password-spraying tests in different environments.
• The presenter advises coordinating tests with clients and reviewing password policies to avoid locking accounts.
• In the demonstrated environment, the presenter reports that Windows Defender real-time protection remained on and AMSI was not triggered; this is specific to the demonstration.