timsonner Impacket GetUserSPNs
Purpose
Use this skill to review SPN-bearing accounts and Kerberoasting exposure in approved AD environments.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Threat Modeling and Test Planning, Retest and Closure
Use When
- Need to identify SPN-bearing accounts and assess service-account risk.
- Need to understand whether Kerberos exposure is materially relevant.
- Need a repeatable retest after service-account hardening.
Avoid When
- The domain or credential scope is not explicit.
- Requesting ticket material would exceed the approved impact level.
Inputs
- Approved domain and controller
- Authorized account or explicitly allowed anonymous context
- Objective such as enumeration only or controlled ticket request
Procedure
- Start with enumeration only.
- Identify only the accounts that materially change risk.
- Escalate to deeper validation only when explicitly approved.
- Correlate the result with privilege, password policy, and business impact.
- Preserve the exact scope for retest.
Command Syntax
Replace sample domains and credentials with approved in-scope values.
# Enumerate accounts with SPNs (Kerberoastable)
GetUserSPNs.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10
# Request TGS tickets for offline cracking
GetUserSPNs.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10 -request -outputfile contoso-tgs.txt
# Output in Hashcat format
GetUserSPNs.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10 -request -format hashcat -outputfile contoso-tgs.hashcat
# Pass-the-Hash
GetUserSPNs.py -hashes :<NTLM_hash> contoso.com/auditor -dc-ip 10.10.10.10 -request -outputfile contoso-tgs.txt
Evidence to Capture
- SPN-bearing accounts relevant to service-account risk
- Whether controlled ticket requests were approved and performed
- Domain and controller context used during the check
Safety Boundaries
- Default to enumeration-only unless stronger validation is explicitly approved.
- Protect any returned ticket material as sensitive evidence.