GhostPack/Rubeus
Rubeus
Rubeus is a comprehensive Kerberos attack toolkit for Active Directory environments, written in C#. It provides a full suite of operations for manipulating Kerberos tickets, exploiting delegation configurations, and performing credential attacks against Windows domains.
The toolkit enables ticket extraction from logon sessions and memory, with real-time monitoring via Event Tracing for Windows. It supports forging golden and silver tickets with arbitrary privileges, as well as the creation of forged delegation contexts. Delegation attacks include abuse of constrained and unconstrained delegation, S4U2Self and S4U2Proxy exploitation, and the Bronze Bit vulnerability bypass. For credential recovery, Rubeus performs Kerberoasting and AS-REP roasting, and can compute Kerberos encryption keys from passwords.
Its capabilities extend to ticket renewal, proxy-routed ticket requests, service principal name substitution, and cached ticket enumeration with detailed inspection and decryption. The toolkit interacts directly with the Local Security Authority subsystem and the Kerberos ticket cache to insert, remove, or modify tickets as needed.
Features
- LSA Authentication Ticket Interfaces - Interacts with the Local Security Authority subsystem via native API calls to extract and manipulate authentication tickets from logon sessions.
- Kerberos Ticket Requesters from KDC - Requests Kerberos tickets from the KDC with configurable encryption types, proxy routing, and stealth options.
- Kerberos Encryption Key Negotiations - Handles Kerberos encryption type negotiation and performs cryptographic operations including ticket decryption and forgery.
- ASN.1 DER Message Builders - Builds and decodes ASN.1 DER-encoded Kerberos messages for ticket requests and responses with validation.
- Automated Kerberos Attacks - Automating Kerberos-based attacks such as ticket forging, extraction, and impersonation for penetration testing of Active Directory environments.
- Kerberos Ticket Cache Manipulators - Inserts, removes, and modifies Kerberos tickets in the local authentication cache via session interaction and service name substitution.
- Kerberos Ticket Extractors - Extracts Kerberos tickets from logon sessions and memory with optional continuous monitoring.
- Kerberos Service Ticket Roasters - Performs Kerberoasting and AS-REP roasting to capture hashes for offline password cracking.
- Kerberos Ticket Forgers - Creates forged golden and silver tickets with arbitrary user and group information for privilege escalation.
- Kerberos Ticket Injectors - Imports, purges, and modifies Kerberos tickets in logon sessions, including key editing and name substitution.
- S4U Service Ticket Requests - Requests service tickets via S4U delegation extensions to impersonate users and access services.
- Lateral Movement Techniques - Moving laterally across a Windows domain by manipulating Kerberos tickets, performing delegation attacks, and requesting service tickets on behalf of other users.
- Kerberos Constrained Delegation Exploitations - Exploits constrained delegation configurations to impersonate users and access protected services.
- Kerberos Delegation Exploitation Techniques - Exploiting constrained and unconstrained delegation configurations to impersonate privileged users and access protected services.
- Service Principal Name Substitutions - Substitutes service principal names into existing tickets for lateral movement through the network.
- Credential Renewal - Renews Kerberos tickets before expiry with optional automatic renewal to maintain valid credentials.
- Kerberos Session Inspectors - Parses authentication tickets and logon session information for detailed inspection and analysis.
- Kerberos Ticket Decoders and Decryptors - Decodes and decrypts Kerberos tickets to inspect authorization fields, verify checksums, and extract plaintext data.
- Kerberos Delegation Context Recoveries - Recovers a user's TGT by requesting a fake delegation context and extracting credentials.
- Credential Brute-Forcing - Creates processes with alternate credentials and performs brute-force attacks against Kerberos authentication.
- Bronze Bit Exploitations - Applies the Bronze Bit vulnerability to bypass delegation validation checks during service-for-user operations.
- Kerberos Ticket Event Monitors - Captures new Kerberos ticket events in real time by hooking into the Windows ETW provider for processing.
- Active Directory Exploitation - C# toolset for advanced Kerberos interaction and ticket manipulation.
- Credential and Access Tools - C# toolkit for Kerberos interaction and ticket-based attack execution.
- Credential and Data Extraction - Tool for performing Kerberos-based attacks and Active Directory manipulation.
- Credential Harvesting - Tool for Kerberos interaction and credential theft.
- Offensive Security Frameworks - A C# toolset for interacting with and abusing Kerberos protocols.
- Offensive Security Tools - Tool for Kerberos interaction and exploitation.
- Post Exploitation - Tool for Kerberos interaction and ticket manipulation.
- Post Exploitation Frameworks - Tool for Kerberos interaction and ticket manipulation.
- Security Tooling - Toolset for raw Kerberos interaction and ticket abuse.
- Windows Security Utilities - Tool for interacting with and abusing Kerberos tickets.
