rapid7/metasploit-framework — pull request #2903 by Meatballs1 (2014-01-22 09:46:02+00:00)
Title: Post - Service Principal Name

Lining up some post modules to use the extapi functionality, so branched off previous LDAP work which idealy would be committed first!

This is inspired by https://www.netspi.com/blog/entryid/214/faster-domain-escalation-using-ldap

By default it tries to identify service principal names where the user is a member of the Domain Admins group and should give you a list of servers where you can steal Domain Admin tokens (or cleartext passwords as they should be stored in LSA Secrets?).

N.B. I haven't used this in anger on a proper domain, you can generate a test case using the SetSPN tool on the DC:
https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx

```setspn -s serviceClass/Host:Port AccountName```

```setspn -s HTTP/WebServerHostName test\svc_http```