Impacket GetUserSPNs.py

Back to the Category Index / Back to the Command Index

Overview

Enumerates user account SPNs from LDAP. When requested, it also obtains TGSs and outputs them in a format for offline analysis.

Item	Details
Implementation	`examples/GetUserSPNs.py`
Category	Kerberos / Ticket Handling
Size	541 lines
Distribution	Installed as a script through `scripts=examples/*.py` in `setup.py`

CLI and Inputs

Check python examples/GetUserSPNs.py -h for the current option definitions.

Argument	Description
`target`	`domain[/username[:password]]`
`-target-domain`	Domain to query or request if it differs from the user’s domain; supports Kerberoasting across trusts.
`-no-preauth`	Account without pre-authentication, used to obtain a service ticket through the AS exchange.
`-stealth`	Remove the `(servicePrincipalName=*)` filter from the LDAP query for added stealth. This may consume substantial memory or cause errors in large domains.
`-machine-only`	Query only machine accounts by changing `objectCategory=person` to `objectCategory=computer`. Active Directory may limit results to 1,000 objects by default; LDAP paging is needed for more.
`-usersfile`	File with one user per line to test.
`-request`	Request TGSs for users and output them in JtR/hashcat format (default: false).
`-request-user`	Request a TGS for the SPN associated with the specified user (username only; no domain needed).
`-request-machine`	Request a TGS for the SPN associated with the specified machine, for example `workstation01$`.
`-save`	Save requested TGSs to disk as `<username>.ccache`; also enables `-request`.
`-outputfile`	File for ciphertexts in JtR/hashcat format; also enables `-request`.
`-no-rc4`	Do not force RC4-HMAC for the TGT.
`-ts`	Add timestamps to log output.
`-debug`	Enable debug logging.
`-hashes`	NTLM hashes in `LMHASH:NTHASH` format.
`-no-pass`	Skip the password prompt (useful with `-k`).
`-k`	Use Kerberos authentication. Read credentials from the ccache (`KRB5CCNAME`) based on the target; fall back to command-line credentials if none are valid.
`-aesKey`	128- or 256-bit AES key for Kerberos authentication.
`-dc-ip`	Domain controller IP address. Defaults to the domain (FQDN) in `target`; ignored if `-target-domain` is set.
`-dc-host`	Domain controller hostname. Defaults to the domain (FQDN) in the account parameter.
`-ldaps / -use-ldaps`	Use LDAPS instead of LDAP.

Related technology: the TGS-REP enc-part in Kerberos and SPN searches in LDAP.

Detailed Processing Flow

The command searches LDAP for SPNs, UAC values, and delegation attributes and displays them. With -request / -request-user / -request-machine, it obtains a TGT, sends a TGS-REQ for each SPN to the KDC, and produces a string representation or ccache according to the response enctype. -stealth and -usersfile change how searching or requesting begins.

How It Works

Kerberoasting targets the part of a service ticket encrypted with a user account’s long-term key, not the SPN string itself. The initial LDAP search collects accounts with servicePrincipalName and their UAC and delegation attributes, showing which account owns each service identity.

To request tickets, the caller obtains a TGT from a password, hash, AES key, or ccache, then sends a TGS-REQ for each target SPN. The KDC’s TGS-REP ticket encrypted part is protected with the service account key. The command converts it to hashcat/John format according to the enctype and the placement of checksum and ciphertext. -save writes the response as a separate ccache credential.

-no-rc4 changes the client’s enctype preference, while -stealth and -usersfile change the LDAP discovery method. Because the KDC’s actual enctype selection determines the output format, do not infer RC4 or AES solely from the client’s preference. Across domains, keep the authentication domain, search domain, and KDC distinct.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
`GetUserSPNs`	54	`__init__()`, `printTable()`, `getUnixTime()`, `getTGT()`, `outputTGS()`, `run()`, `request_users_file_TGSs()`, `request_multiple_TGSs()`

Dependencies

Internal Impacket Modules

Module	Main Names Used
`impacket`	`version`
`impacket.dcerpc.v5.samr`	`UF_ACCOUNTDISABLE`, `UF_TRUSTED_FOR_DELEGATION`, `UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION`
`impacket.examples`	`logger`
`impacket.examples.utils`	`ldap_login`, `parse_identity`
`impacket.krb5`	`constants`
`impacket.krb5.asn1`	`AS_REP`, `TGS_REP`
`impacket.krb5.ccache`	`CCache`
`impacket.krb5.kerberosv5`	`getKerberosTGS`, `getKerberosTGT`
`impacket.krb5.types`	`Principal`
`impacket.ldap`	`ldap`, `ldapasn1`
`impacket.ntlm`	`compute_lmhash`, `compute_nthash`

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
`pyasn1`	`pyasn1`	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
Depending on options, creates or updates a local file. Check how existing files are handled and the permissions on output containing secrets.

Failure Paths and Cleanup

On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on LDAP, krb5.kerberosv5 / ccache / asn1 / crypto, pyasn1, and NTLM hash helpers. LDAP records and TGS output formats remain separate within GetUserSPNs.

Verification

Syntax: python -m py_compile examples/GetUserSPNs.py
CLI: python examples/GetUserSPNs.py -h
Related test: tests/SMB_RPC/test_ldap.py
Related test: tests/SMB_RPC/test_ntlm.py
Related test: tests/dcerpc/test_samr.py
Related test: tests/misc/test_ccache.py
Related test: tests/misc/test_krb5_crypto.py
Related test: tests/misc/test_krb5_gssapi.py