Add orphan-spns module - #1449

Description

This module enumerates orphaned constrained-delegation SPNs: SPNs listed in an account's msDS-AllowedToDelegateTo attribute that aren't registered to any account in the domain.

The STRICT option also enumerates the targets where the exact SPN is unregistered but the host exists.

These SPNs can be used to perform a SPN Jacking attack. This technique is explained in this blog post: SPN-jacking: An Edge Case in WriteSPN Abuse

AI Assistance

This module was created with Claude Code (Claude Opus 4.8). The code was generated by the AI. I reviewed the code, refined the output wording and formatting, and cleaned up the comments. I also tested it on a Windows Server 2022 lab.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

• Set a machine constrained-delegation attribute (msDS-AllowedToDelegateTo) with a non-existent SPN.

Screenshots (if appropriate):

• Target System: Windows Server 2022

• With the STRICT option:

Checklist:

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)