← Back to Academy

Academy Node

SPN Found

An SPN on a user account usually means the account is Kerberoastable.

Beginner100 XPFinding

Why it matters

Service accounts are often privileged and sometimes use weak passwords.

How to identify it

  • LDAP servicePrincipalName attribute
  • BloodHound Kerberoastable
  • GetUserSPNs finds users

BloodHound indicators

  • User has SPN

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --kerberoasting kerb.txt

Impacket commands

impacket-GetUserSPNs xutslabs.local/ba_low:'Password123' -dc-ip 192.168.184.141 -request -outputfile kerb.txt

Expected output

  • $krb5tgs$23$

Success looks like

  • TGS hash obtained

Failure looks like

  • No SPNs
  • No crack

Troubleshooting

  • Try RC4 downgrade if allowed
  • Use current creds

Common mistakes

  • Ignoring MSSQLSvc SPNs
  • Not checking cracked user's privileges

Alternative attacks

  • ASREP
  • Targeted Kerberoast

What to try next

  • Kerberoast
  • Crack
  • Validate creds

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.