Impacket GetUserSPNs

GetUserSPNs.py -request <domain>/<user>:'<pass>' -dc-ip <dc-ip>

Requests TGS for accounts with SPN from Linux using impacket for Kerberoasting.

When you have domain credentials and access from a Linux system. It is the alternative to Rubeus in environments without Windows. Useful when you are on a compromised Linux host and want to obtain hashes without moving to a Windows host.

If the domain uses smartcard authentication or Windows Hello, GetUserSPNs.py may fail due to Kerberos restrictions. Also not if the DC's EDR detects authentications from unexpected IPs.