> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/remote-enumeration/get-user-information-remotely.md).

# Get User Information Remotely

Tools that can be used to get information about a specific AD-user or get logged-on users.

## Get Logged-on Users

### Enumeration with NetExec

To enumerate logged-on users with `nxc`

```bash
nxc smb $TARGET_IP -u <user> -p '<password>' --loggedon-users
```

## Get SPNs

A *service principal name (SPN)* is a unique identifier of a service instance. [Kerberos authentication](https://learn.microsoft.com/en-us/windows/win32/ad/mutual-authentication-using-kerberos) uses SPNs to associate a service instance with a service sign-in account. Doing so allows a client application to request service authentication for an account even if the client doesn't have the account name.

Before the Kerberos authentication service can use an SPN to authenticate a service, the SPN must be registered on the account object that the service instance uses to sign in. A given SPN can be registered on only one account. For Win32 services, a service installer specifies the sign-in account when an instance of the service is installed. The installer then composes the SPNs and writes them as a property of the account object in Active Directory Domain Services.

SPN Format: `<service class>/<host>:<port>/<service name>`

Examples:

* `MSSQLSvc/sql.lab.local:1433/SQLEXPESS`
* `CIFS/files.lab.local`

### Get SPNs with GetUserSPNs.ps1

GetUserSPNs.ps1 is part of the Kali [kerberoast package](https://www.kali.org/tools/kerberoast/).

```powershell
```

### Get SPNs with Impacket

#### GetUserSPNs.py

[GetUserSPNs.py](https://github.com/fortra/impacket/blob/master/examples/GetUserSPNs.py) queries target domain for SPNs that are running under a user account.

To list SPNs

```bash
impacket-GetUserSPNs -dc-ip $DC_IP <domain>/<dom_user>:<dom_user_pw> 
```

## Get User Information

Below are examples of tools that can be used to get information about a specific **AD/domain** user.&#x20;

For **local** users, see [Windows User Information](/ctf-notes/enum/windows-discovery/windows-user-information.md).

### Get User Info with Impacket

#### Get user info with net.py

[net.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/net.py) is an Impacket alternative for windows net.exe commandline utility. Thanks to RPC protocol, this tool is making net.exe functionalities available from remote computer.

To get information on a specific domain/local user account

```bash
impacket-net domain.local/user:password@$TARGET_IP user -name "<user_account>"
```

To get information on a specific domain computer account

```bash
impacket-net domain.local/user:password@$TARGET_IP computer -name "<comp_account>"
```

## Resources

Active Directory - Enumeration - Internal All The Things: <https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adds-enumerate/>

**Impacket** - GitHub: <https://github.com/fortra/impacket>

**Impacket** - Homepage: <https://www.coresecurity.com/core-labs/impacket>

**Impacket** - Kali Tools: <https://www.kali.org/tools/impacket/>

**Impacket-scripts** - Kali Tools: <https://www.kali.org/tools/impacket-scripts/>

**NetExec** - GitHub: <https://github.com/Pennyw0rth/NetExec>

**NetExec** - Kali Tools: <https://www.kali.org/tools/netexec/>

**NetExec** - Wiki: <https://www.netexec.wiki>