GetUserSPNs.py
Kerberoasting: service tickets of SPN accounts (impacket).
GetUserSPNs.py (Impacket) performs Kerberoasting: it requests the service tickets (TGS) of accounts with a registered SPN and returns a crackable hash. If the service account's password is weak, it is recovered offline. It needs valid domain credentials.
Family Kerberos & tickets
Flags -request -dc-ip
Concepts Kerberoasting, Hash Cracking
Cheatsheet Kerberos
Installation
# All of Impacket's *.py tools ship in the same package:
pipx install impacket
# invoke them as impacket-<tool> or <Tool>.py depending on the packagingUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- ActiveHackTheBox
- AdministratorHackTheBox
- CertifiedHackTheBox
- HokkaidoProving Grounds Practice
- NagoyaProving Grounds Practice