Skip to main content

​
spray

The spray command performs password spraying across multiple protocols. It takes a credential (username and password or hash) and tests it against a list of target servers, supporting lockout awareness and configurable threading.

​
Usage

r4t spray <protocol> [targets...] [flags]

​
Persistent Flags

These flags apply to all spray subcommands:
FlagShortDescription
--db-users—Spray using users without credentials from the database
--dcs—Load domain controllers from the database as targets
--stop-on-success-SStop when a successful authentication is found
--stop-on-lockout-LStop when an account lockout is detected
--user-as-pass-UUse the username as the password for each account
--threads-TNumber of concurrent spray threads (default: 10)

​
Subcommands

​
spray kerberos

Spray credentials via the Kerberos protocol (AS-REQ). This is the most evasion-friendly method as it does not touch LDAP or SMB directly. 
r4t spray kerberos <method> [servers...] [flags]

​
spray kerberos pwd

Kerberos password spraying — sends AS-REQs and checks for valid authentication responses. 
# Spray against the stored target
r4t spray kerberos pwd

# Spray against specific servers
r4t spray kerberos pwd dc01.corp.example.com dc02.corp.example.com

# Spray all DCs from the database
r4t spray kerberos pwd --dcs

# Use safe mode (stop on first lockout)
r4t spray kerberos pwd --stop-on-lockout

# Force RC4 encryption (downgrade)
r4t spray kerberos pwd --downgrade
FlagDescription
--safeSafe mode — abort spray if any user lockout is detected
--downgradeForce downgraded encryption (arcfour-hmac-md5 / RC4)

​
spray kerberos enum

Kerberos user enumeration — determines whether usernames exist by analyzing AS-REQ error responses without attempting to authenticate. This does not cause lockouts. 
# Enumerate users from a wordlist against DC
r4t spray kerberos enum dc01.corp.example.com

# Use usernames from database (users without credentials)
r4t spray kerberos enum --db-users dc01.corp.example.com
FlagDescription
--safeSafe mode
--downgradeForce RC4 encryption

​
spray smb

Password spraying via SMB authentication (port 445). 
# Spray against specific targets
r4t spray smb 10.10.10.20 10.10.10.21

# Spray with local authentication (don't append domain)
r4t spray smb --local 10.10.10.20

# Spray all stored targets using threads
r4t spray smb --threads 20 --stop-on-success
FlagDescription
--localUse local authentication — do not append domain prefix

​
spray ldap

Password spraying via LDAP bind. 
r4t spray ldap dc01.corp.example.com

# Spray all DCs
r4t spray ldap --dcs

​
spray ssh

Password spraying via SSH. 
r4t spray ssh 10.10.10.50 10.10.10.51

# Stop on first success
r4t spray ssh --stop-on-success 10.10.10.50

​
spray ftp (planned)

FTP password spraying. Not yet implemented.

​
spray mssql (planned)

MSSQL password spraying. Not yet implemented.

​
spray winrm (planned)

WinRM password spraying. Not yet implemented.

​
spray tftp (planned)

TFTP spraying. Not yet implemented.

​
Target Specification

Targets can be specified in multiple ways: 
# Inline hostname or IP
r4t spray smb 10.10.10.10

# Multiple targets
r4t spray smb 10.10.10.10 10.10.10.20 10.10.10.21

# Load DCs from database
r4t spray kerberos pwd --dcs

# Uses stored target (default) if no targets specified
r4t spray ldap

​
Spray Results Storage

All spray operations are recorded in the sprays table in SQLite:
ColumnDescription
TargetServer that was sprayed
ProtocolProtocol used
UsernameAccount sprayed
StatusSuccess / Failure / Locked
TimestampWhen the attempt was made
Successful credentials are automatically added to the credentials table.

​
Lockout Safety

R4t provides multiple layers of lockout protection:
FeatureFlagBehavior
Stop on lockout--stop-on-lockout / -LHalt all spraying when any lockout is detected
Safe mode (Kerberos)--safeAbort Kerberos spray if lockout detected
Stop on success--stop-on-success / -SStop after first valid authentication
Jitter--jitter (global)Add random delay between attempts
Recommended for production engagements: Always use --stop-on-lockout and check the domain password policy via r4t ldap get users before spraying.

​
Common Spray Workflows

# 1. Check password policy first
r4t ldap get users  # check lockout threshold

# 2. Enumerate valid usernames (no lockout risk)
r4t spray kerberos enum --dcs

# 3. Spray a single password carefully
r4t spray kerberos pwd --dcs --stop-on-lockout -p 'Winter2024!'

# 4. Spray SMB on workstations
r4t spray smb --threads 5 --stop-on-lockout 10.10.10.20 10.10.10.21

# 5. Use username as password (common misconfiguration)
r4t spray kerberos pwd --dcs --user-as-pass --stop-on-lockout