Skip to content

Commit

Permalink
GetUserSPNs.py, impacket-GetUserSPNs: add page (#15881)
Browse files Browse the repository at this point in the history
* Create getuserspns.py.md

* Create impacket-getuserspns.md

* Update getuserspns.py.md

Trivial mistake.
  • Loading branch information
MachiavelliII authored Mar 10, 2025
1 parent c6720f4 commit c8d735d
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 0 deletions.
25 changes: 25 additions & 0 deletions pages/common/getuserspns.py.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# GetUserSPNs.py

> Retrieve Service Principal Names (SPNs) associated with Active Directory user accounts.
> Part of the Impacket suite.
> More information: <https://github.com/fortra/impacket>.
- Enumerate user accounts with an SPN and request their Kerberos TGS tickets:

`GetUserSPNs.py {{domain}}/{{username}}:{{password}} -dc-ip {{domain_controller_ip}}`

- Use pass-the-hash authentication:

`GetUserSPNs.py {{domain}}/{{username}} -hashes {{LM_Hash}}:{{NT_Hash}} -dc-ip {{domain_controller_ip}}`

- Save the output to a file:

`GetUserSPNs.py {{domain}}/{{username}}:{{password}} -dc-ip {{domain_controller_ip}} -outputfile {{output_file}}`

- Request only TGS tickets:

`GetUserSPNs.py {{domain}}/{{username}}:{{password}} -dc-ip {{domain_controller_ip}} -request`

- Request only TGS tickets using pass-the-hash authentication:

`GetUserSPNs.py {{domain}}/{{username}} -dc-ip {{domain_controller_ip}} -hashes {{LM_Hash}}:{{NT_Hash}} -request`
9 changes: 9 additions & 0 deletions pages/common/impacket-getuserspns.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# impacket-GetUserSPNs

> This command is an alias of `GetUserSPNs.py`.
> Part of the Impacket suite.
> More information: <https://github.com/fortra/impacket>.
- View documentation for the original command:

`tldr GetUserSPNs.py`

0 comments on commit c8d735d

Please sign in to comment.