Red-Team Tutorial Demonstrates Password Spraying Against Active Directory with Sliver and NetExec
· 21:09 · Watch on YouTube ↗
Summary
A red-team tutorial demonstrates password spraying against an intentionally misconfigured Active Directory lab using Sliver C2 and NetExec, including password-policy checks, LDAP user enumeration and a SOCKS5 pivot. The presenter reports obtaining domain-admin access.
Key points
- The presenter contrasts brute-force attempts against a few accounts with password spraying a small number of passwords across many users to reduce account-lockout risk.
- The tutorial emphasizes checking password policy before spraying; its lab is described as intentionally misconfigured, with no lockout threshold and a 30-minute observation window.
- A Sliver C2 beacon and its modules are used for password-policy checks, LDAP user enumeration and spraying. The presenter claims Beacon Object Files may be less detectable than PowerShell assemblies.
- A second approach uses a Sliver SOCKS5 tunnel and Proxychains to route NetExec traffic through the beacon host to the domain controller.
- The NetExec demonstration covers LDAP user enumeration and password spraying, including username-as-password attempts; the presenter reports successful domain-admin authentication in the lab.
Article Details
- Topics
- [00:54] Password spraying compared with brute force and account-lockout risk
- [05:16] Sliver C2 and proxy-based approaches to password spraying
- [10:00] Sliver demonstration of password-policy checks and spraying in a misconfigured lab
- [14:31] SOCKS5 tunneling to reach the domain controller
- [16:00] NetExec LDAP enumeration and password-spraying demonstration
MITRE ATT&CK
T1078.002 · Domain AccountsThe presenter reports successful authentication as a domain administrator using credentials obtained in the lab demonstration.T1087.002 · Domain AccountThe tutorial demonstrates enumerating domain users through LDAP.T1090.001 · Internal ProxyThe tutorial demonstrates using a SOCKS5 tunnel through a beacon host to reach an internal domain controller.T1110.003 · Password SprayingThe tutorial demonstrates password spraying against multiple domain accounts.