Spraykatz

Spraykatz is a tool designed to extract credentials from Windows systems, particularly in large Active Directory environments. It operates by remotely deploying procdump to target machines, capturing memory dumps, and parsing them for sensitive credential data. This approach minimizes detection by antivirus software since no local agent is required on the attacker's machine.

The tool requires the specified user to have administrative privileges on target systems to achieve remote code execution. It supports both individual IP addresses and ranges, making it suitable for spraying across multiple hosts in a network. Use cases include post-exploitation scenarios where initial access has been gained, and domain credentials are needed for lateral movement or privilege escalation.

Caution is advised as the tool explicitly warns against use in production environments. A cleanup mode is available to remove procdump binaries and leftover dumps from compromised systems.

Spraykatz uses remote code execution on Windows targets via administrative credentials (username/password or NTLM hash). It deploys procdump remotely to capture LSASS process memory dumps containing credentials. These dumps are then retrieved and parsed using pypykatz for credential extraction, avoiding local antivirus triggers by performing all operations remotely.