{"id":1508,"date":"2015-04-12T23:28:34","date_gmt":"2015-04-13T03:28:34","guid":{"rendered":"http:\/\/adsecurity.org\/?p=1508"},"modified":"2018-04-12T18:02:54","modified_gmt":"2018-04-12T22:02:54","slug":"spn-scanning-service-discovery-without-network-port-scanning","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=1508","title":{"rendered":"SPN Scanning – Service Discovery without Network Port Scanning"},"content":{"rendered":"

The best way to discover services in an Active Directory environment is through what I call “SPN Scanning.”<\/p>\n

The primary benefit of SPN scanning for an attacker over network port scanning is that SPN scanning doesn’t require connections to every IP on the network to check service ports. SPN scanning performs service discovery via LDAP queries to a Domain Controller. Since SPN queries are part of normal Kerberos ticket behavior, it is difficult, if not infeasible to detect, while netowkr port scanning is pretty obvious.<\/p>\n

Service Principal Names (SPNs)<\/a> are required for discovery of services that leverage Kerberos authentication.<\/p>\n

<\/p>\n

From the Microsoft Kerberos specification<\/a>:<\/p>\n

An SPN is a string of the following format. For more information on the <alphanum> element, see [RFC2396] section 1.6.
\nSPN = serviceclass “\/” hostname [“:”port] [“\/” servicename]
\nserviceclass = alphanum
\nservicename = alphanum
\nWhere:
\nserviceclass is a string that identifies the class of the service, such as “www” for a Web service or “ldap” for a directory service.
\nhostname ([RFC2396] section 3.2.2) is a string that is the name of the system. This SHOULD be the fully qualified domain name (FQDN).
\nport ([RFC2396] section 3.2.2) is a number that is the port number for the service.<\/p>\n

The servicename segment is a string that is the distinguished name (DN), objectGuid, Internet host name, or fully qualified domain name (FQDN) for the service.
\nAn application can supply a name of the form “RestrictedKrbHost\/<hostname>” when its callers have provided the hostname but not the correct SPN for the service. Applications SHOULD NOT use “RestrictedKrbHost\/<hostname>” due to the security considerations in section 5.1.2. Applications calling GSS-API directly MUST provide a target name which SHOULD be an SPN<28> for their service applications for Kerberos authentication.<\/p><\/blockquote>\n

Some of the more interesting services and example SPNs<\/a>:<\/p>\n