Enumeration Through Service Principal Name
To enumerate SPNs in the domain, we have multiple options.
In this case, we’ll use setspn.exe, which is installed on Windows by default.
We’ll use -L to run against both servers and clients in the domain.
While we could iterate through the list of domain users,
we previously discovered the iis_service user.
Let’s start with that one:
The output shows an SPN is linked to the iis_service account.
Another way of enumerating SPNs is to let
PowerView enumerate all the accounts in the domain.
To obtain a clear list of SPNs, we can pipe the output into select
and choose the samaccountname and serviceprincipalname attributes:
While we will explore the krbtgt account in upcoming AD-related Modules,
for now, we’ll continue to focus on iis service.
The serviceprincipalname of this account is indicative of a web server.
Let’s attempt to resolve web04.corp.com with nslookup:
From the result,
it’s clear that the hostname resolves to an internal IP address.
If we browse this to this IP,
we find a website that requires a login:
Since these types of accounts are used to run services,
we can assume that they have more privileges
than regular domain user accounts.
For now, we’ll simply document that iis_service has a linked SPN,
which will be valuable for us in the upcoming AD-related Modules.