CmdID

CmdID / Commands

getuserspns.py

Retrieve Service Principal Names (SPNs) associated with Active Directory user accounts. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Retrieve Service Principal Names (SPNs) associated with Active Directory user accounts. Part of the Impacket suite.

Enumerate user accounts with an SPN and request their Kerberos TGS tickets

GetUserSPNs.py domain/username:password -dc-ip domain_controller_ipIdentify

Use pass-the-hash authentication

GetUserSPNs.py domain/username -hashes LM_Hash:NT_Hash -dc-ip domain_controller_ipIdentify

Save the output to a file

GetUserSPNs.py domain/username:password -dc-ip domain_controller_ip -outputfile path/to/output_fileIdentify

Request only TGS tickets

GetUserSPNs.py domain/username:password -dc-ip domain_controller_ip -requestIdentify

Request only TGS tickets using pass-the-hash authentication

GetUserSPNs.py domain/username -dc-ip domain_controller_ip -hashes LM_Hash:NT_Hash -requestIdentify