Enumerating Service Accounts
When a User executes an application, that user account defines the context. Services run under Service accounts, which may have higher privileges. Here is how we can enumerate Services.
S_ervice Principal Name_ (SPN)
Service Principal Name (SPN) associates a service account to a specific service in Active Directory.
We can obtain IP addresses and port numbers of applications running on Active Directory by simply enumerating all SPN's in the domain. All information is stored on the Domain Controller.
Query Domain Controller - setspn.exe
We discovered a "iis_service" Service Account. Let's enumerate it with setspn.exe.
Query Domain Controller - PowerView
A easier way is to let PowerView query all accounts on the domain and filter by SPN.
Further Enumeration
Going backt to the "iis_service" account we discovered we notice it's running a web server. We can get the IP address by querying with nslookup
NOTE: We can browser to that IP address, for now we'll document that it's attached to a Service Account which is likely higher privilege than a User Account.
Impacket GetUserSPNs
If we have credentials to a domain user we can use Impacket's GetUserSPN's script
Last updated