diff --git a/pages/common/getuserspns.py.md b/pages/common/getuserspns.py.md new file mode 100644 index 0000000000..fcff5efd34 --- /dev/null +++ b/pages/common/getuserspns.py.md @@ -0,0 +1,25 @@ +# GetUserSPNs.py + +> Retrieve Service Principal Names (SPNs) associated with Active Directory user accounts. +> Part of the Impacket suite. +> More information: . + +- Enumerate user accounts with an SPN and request their Kerberos TGS tickets: + +`GetUserSPNs.py {{domain}}/{{username}}:{{password}} -dc-ip {{domain_controller_ip}}` + +- Use pass-the-hash authentication: + +`GetUserSPNs.py {{domain}}/{{username}} -hashes {{LM_Hash}}:{{NT_Hash}} -dc-ip {{domain_controller_ip}}` + +- Save the output to a file: + +`GetUserSPNs.py {{domain}}/{{username}}:{{password}} -dc-ip {{domain_controller_ip}} -outputfile {{output_file}}` + +- Request only TGS tickets: + +`GetUserSPNs.py {{domain}}/{{username}}:{{password}} -dc-ip {{domain_controller_ip}} -request` + +- Request only TGS tickets using pass-the-hash authentication: + +`GetUserSPNs.py {{domain}}/{{username}} -dc-ip {{domain_controller_ip}} -hashes {{LM_Hash}}:{{NT_Hash}} -request` diff --git a/pages/common/impacket-getuserspns.md b/pages/common/impacket-getuserspns.md new file mode 100644 index 0000000000..a373b39c2b --- /dev/null +++ b/pages/common/impacket-getuserspns.md @@ -0,0 +1,9 @@ +# impacket-GetUserSPNs + +> This command is an alias of `GetUserSPNs.py`. +> Part of the Impacket suite. +> More information: . + +- View documentation for the original command: + +`tldr GetUserSPNs.py`