> For the complete documentation index, see [llms.txt](https://www.insidepwn.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.insidepwn.com/blogs/attacks/spn-jacking.md).

# SPN-Jacking

#### **SPN jacking is an edge case in the WriteSPN abuse**

**What is WriteSPN ?**

* WriteSPN is the ability to change the value of attribute servicePrincipalName of an object in active directory
* An attacker can abuse this to perform an attack called targeted Kerberoasting on that user

### 1. Ghost SPN Jacking

<figure><img src="/files/vSXjmgilq3BD0Ibksiam" alt=""><figcaption></figcaption></figure>

* Now in this scenario Account A has Constriained Delegation to a SPN which was associated with a computer or service account that no longer exists
* Either it can be the account now doesn't exist , the account might have been renamed and SPN has be updated
* But in a nutshell the SPN is a GHOST
* What we can do here we can add that particular SPN to the DC with the help of Account B and perform Constrained Delegation attack and get the Service Ticket but there is a twist that the SPN used to get the Service Ticket is worthless as the Service was not really meant for DC or the Service itself is useless for attack perspective
* So to now make this whole thing work we can change the SNAME (Service Name) as the sname is not the encrypted part of ticket so it can be changed

{% hint style="info" %}
PS :- Use `altservice` flag in Rubeus or getST.py in impacket to make things work
{% endhint %}

### 2. Live SPN Jacking

<figure><img src="/files/hqqnCbdbz4UkqR0hPMQ9" alt=""><figcaption></figcaption></figure>

* here the attacker has access to account A which in turn has Constrained Delegation to Account C and the attacker also owns Account B which has WriteSPN over DC and Account C
* To perform the attack the attacker can remove the SPN from account C which is set to be delegated through account A and add that SPN to DC , so we remove SPN from one place and add to another
* But the ticket won't work for DC as Service is not really present or the Serivce is really useless , so with the help of `altservice` flag we can change the `SNAME` (serviceName)

For Example , if we have `http/WEB01` which is SPN set for constrained delegation we can change it to `cifs/dc01.something` and can use it to `access file shares` and in turn can use this to dump hashes / credentials but this is possible if the services share the same encryption key