Active Directory Brute Force Tool

[freedompeace]

No one will probably find this useful... but... here's something I spent the last 5 minutes working on. It "tests" the security of a Active Directory user (so Active Directory, Windows domain logon etc...) by doing a dictionary attack.

This won't work if the server rate limits login attempts or anything, however. Also, there's an easier method to this, by just copying the cached password hashes and cracking them on a GPU (which is 10000x more efficient), but I don't have that liberty because I don't have physical access to the computers that the targets have logged into.

150MB worth of common passwords are provided.

Usage:

network.exe domain username [-update] [-nocrack]

Switches available:

• -update: Updates the password dictionary by merging all files in the resources/databases directory. It is assumed that on every line is a password. Empty lines are ignored.
• -nocrack: Does not attempt to find the password.

Progress is automatically saved every 1000 attempts, and successful combinations are stored somewhere under the ./resources directory (forgot where).

This has not been tested, I will be testing it live on Monday and if it works, giving the network administrator a little surprise :)

Source code and binaries attached. Code has not been refractored.

Requires .NET 3.5 to execute.

Download the binaries and source now.
(too large to upload to MPGH, unless you want 1000 parts)

[Nathan]

Is it still uploading?

[freedompeace]

Is it still uploading?

Oh, the state of Australian internet. I'm uploading at a fine 10kB/s, and the rest of my internet connection doesn't work because I'm maxing my upload.

I will edit my post with the download link when the upload is complete, as currently inferred.

EDIT: file has been finally uploaded, and is available for download.

[Lyoto Machida]

Nice .

[Hell_Demon]

~ Link Approved ~

[Nathan]

I'll have a look at it when I get home

[freedompeace]

Where'd be edit button go?

Anyway, I've just got the network administrator's credentials in under an hour.

A few code changes need to be made:
Under "Program.cs", change the line from

ActiveDirectoryServices.GetCrackin(args[1], args[2]);

to

ActiveDirectoryServices.GetCrackin(args[0], args[1]);

Turns out C# truncates the first argument (the current directory).

Also,

./resources/resume/

must be present otherwise StreamWriter won't be able to open a file there. You can add this to the code if you want.

[Leandro Alves]

Nice Job!

Link or source?

Link 404


Thanks!