Enumerating services and hunting for users
To continue our enumeration, the next step will be to identify available services, file and SQL servers, and the privileged users’ activity in the domain. As we discussed at the beginning of this chapter, our target is to get access to critical data and services in the compromised environment.
SPN
Service Principal Names (SPNs) are the names by which a Kerberos client uniquely identifies instances of a service for a given Kerberos target computer. There is a comprehensive list of known SPNs for Active Directory held by PyroTek3[20]. We can use them to better understand what services are present in the domain and use Kerberos authentication.
We can enumerate SPN in the domain by using the setspn utility or SharpView with the following commands to find users and computers with SPNs:
Get-DomainComputer -ServicePrincipalName "*" Get-DomainUser -SPN
To get all SPNs with the setspn utility, we can run the following...
