WAD · Tool
Rubeus' `asreproast` module will attempt to harvest the non-preauth AS_REP responses for a given list of usernames. These responses will be encrypted with the user's password, which can then be cracked offline. The following command is run on a Windows machine in the victim domain. Command Reference: Output File: hashes.txt
Rubeus' `asktgt` module uses a valid user's NTLM hash to request Kerberos tickets, in order to access any service or machine where that user has permissions. Command Reference: Domain: test.local Username: john Hash: 2a3de7fe356ee524cc9f3d579f2e0aa7
Rubeus' `brute` module bruteforces and enumerates valid Active Directory accounts through Kerberos Pre-Authentication. The following command will attempt to brute force valid username and passwords logins given a list of usernames and a list of passwords. Command Reference: Domain: test.local Username List: usernames.txt Password List: passwords.txt Output File: found_passwords.txt
Rubeus' `kerberoast` module will attempt to fetch Service Principal Names that are associated with normal user accounts. What is returned is a ticket that is encrypted with the user account's password, which can then be bruteforced offline. The following command is run on a Windows machine in the victim domain. Command Reference: Output File: hashes.txt
Rubeus' `s4u` module performs Kerberos constrained delegation attacks using the S4U2Self and S4U2Proxy. This technique abuses accounts configured with delegation privileges (msDS-AllowedToDelegateTo) to impersonate any domain user and further alter the service specified since SPNs are stored in plaintext and thus access any service on the target system as any user Command Reference: Domain: test.local SPN: time/dc.test.local alternative service: ldap(can chose any valid services such as HTTP for remoting access) Username: john$ Hash: 2a3de7fe356ee524cc9f3d579f2e0aa7
Rubeus describe parses a ticket (TGT or service ticket) and prints its metadata: user, realm, service name, encryption type, flags, start/end/renew-till times and the session key. It does not touch the network, making it a safe way to inspect captured or forged tickets before use. Supplying a service/krbtgt key allows it to also decrypt and display the embedded PAC. Command Reference: Ticket file: ticket.kirbi
Rubeus diamond forges a diamond ticket by requesting a real TGT for a valid account, decrypting it with the krbtgt key, modifying the embedded PAC (user, RID, groups, extra SIDs) and re-encrypting it. Unlike a golden ticket it is derived from a legitimate KDC-issued TGT, so its metadata is internally consistent and far harder to distinguish from genuine tickets. Requires valid credentials for the request plus the krbtgt AES/NT key to re-sign the PAC. Command Reference: Username: john Password: password123 AES256 krbtgt key: 5db474e563f34e4bb62e04eecd4a6f92 Domain: test.local
Rubeus dump extracts Kerberos tickets from LSA memory. When elevated it dumps tickets for every logon session on the host; unelevated it returns only the current user's tickets. Filters let you target a specific service (e.g. krbtgt for TGTs) or LUID, and /nowrap keeps the base64 on a single line for easy copy-out and reuse via ptt. Command Reference: Service filter: krbtgt
Rubeus golden forges a TGT signed with the domain krbtgt key, granting arbitrary identity and group membership across the domain until the krbtgt password is rotated twice. Supplying the krbtgt AES256 key with /aes256 produces an AES-encrypted ticket, avoiding the RC4 golden tickets that modern detections flag. Requires the krbtgt key, the domain SID, and typically privileged access to have obtained the key via DCSync. Command Reference: AES256 key: 5db474e563f34e4bb62e04eecd4a6f92 Username: administrator Domain: test.local Domain SID: S-1-5-21-1339291983-1349129144-367733775
Rubeus harvest monitors for new TGTs and automatically renews them before they expire, keeping a working cache of live tickets that can be extracted and reused. It combines the monitor behavior with auto-renewal, which is valuable during long engagements to avoid losing captured tickets to the default 10-hour lifetime. Elevation is required to harvest tickets for all logon sessions. Command Reference: Monitor interval: 30 seconds
Rubeus monitor continuously watches for new Kerberos TGTs as users authenticate to the host, printing any captured tickets on a fixed interval. It is most useful on servers where privileged accounts or delegation targets log on, letting an operator harvest fresh TGTs for pass-the-ticket. Requires an elevated context to see tickets for other logon sessions. Command Reference: Username: john
Over-pass-the-hash (pass-the-key) uses a captured AES or NT key to request a legitimate TGT for that user directly from the KDC, converting a stolen key into full Kerberos access without ever knowing the plaintext password. Using the AES256 key with /aes256 avoids the RC4 (etype 23) downgrade that mature environments alert on, making it more OPSEC-safe than /rc4. The /ptt flag injects the resulting TGT for immediate lateral movement. Command Reference: Username: john AES256 key: 5db474e563f34e4bb62e04eecd4a6f92 Domain: test.local Domain Controller host: dc.test.local
Rubeus ptt performs a pass-the-ticket by submitting a base64 or .kirbi ticket into the current logon session (or a target LUID when elevated). Once injected the ticket is used transparently by Windows for Kerberos authentication to remote services such as SMB, LDAP or WinRM. Use it after obtaining a TGT/TGS via tgtdeleg, dump, monitor, kerberoast/s4u, or Impacket ticketConverter output. Command Reference: Ticket file: ticket.kirbi
Rubeus renew submits a renewal request for an existing TGT to the KDC, returning a fresh ticket with an extended validity window. It accepts either a base64 blob or a .kirbi file and can auto-renew repeatedly up to the ticket's renew-till limit, which helps maintain access without re-authenticating. Combine with /ptt to inject the renewed ticket into the current session. Command Reference: Domain Controller host: dc.test.local
Rubeus tgtdeleg abuses the Kerberos GSS-API delegation mechanism to obtain a usable TGT (including its session key) for the current user context without requiring local administrator rights. It requests a service ticket for a target SPN with the delegation flag set, then extracts the forwarded TGT that the KDC embeds, yielding a .kirbi that can be passed to another host. Use it for pass-the-ticket from an unprivileged foothold when you cannot dump LSASS. Command Reference: Domain Controller host: dc.test.local