GhostPack/Rubeus

Features

• LSA Authentication Ticket Interfaces - Interacts with the Local Security Authority subsystem via native API calls to extract and manipulate authentication tickets from logon sessions.
• Kerberos Ticket Requesters from KDC - Requests Kerberos tickets from the KDC with configurable encryption types, proxy routing, and stealth options.
• Kerberos Encryption Key Negotiations - Handles Kerberos encryption type negotiation and performs cryptographic operations including ticket decryption and forgery.
• ASN.1 DER Message Builders - Builds and decodes ASN.1 DER-encoded Kerberos messages for ticket requests and responses with validation.
• Automated Kerberos Attacks - Automating Kerberos-based attacks such as ticket forging, extraction, and impersonation for penetration testing of Active Directory environments.
• Kerberos Ticket Cache Manipulators - Inserts, removes, and modifies Kerberos tickets in the local authentication cache via session interaction and service name substitution.
• Kerberos Ticket Extractors - Extracts Kerberos tickets from logon sessions and memory with optional continuous monitoring.
• Kerberos Service Ticket Roasters - Performs Kerberoasting and AS-REP roasting to capture hashes for offline password cracking.
• Kerberos Ticket Forgers - Creates forged golden and silver tickets with arbitrary user and group information for privilege escalation.
• Kerberos Ticket Injectors - Imports, purges, and modifies Kerberos tickets in logon sessions, including key editing and name substitution.
• S4U Service Ticket Requests - Requests service tickets via S4U delegation extensions to impersonate users and access services.
• Lateral Movement Techniques - Moving laterally across a Windows domain by manipulating Kerberos tickets, performing delegation attacks, and requesting service tickets on behalf of other users.
• Kerberos Constrained Delegation Exploitations - Exploits constrained delegation configurations to impersonate users and access protected services.
• Kerberos Delegation Exploitation Techniques - Exploiting constrained and unconstrained delegation configurations to impersonate privileged users and access protected services.
• Service Principal Name Substitutions - Substitutes service principal names into existing tickets for lateral movement through the network.
• Credential Renewal - Renews Kerberos tickets before expiry with optional automatic renewal to maintain valid credentials.
• Kerberos Session Inspectors - Parses authentication tickets and logon session information for detailed inspection and analysis.
• Kerberos Ticket Decoders and Decryptors - Decodes and decrypts Kerberos tickets to inspect authorization fields, verify checksums, and extract plaintext data.
• Kerberos Delegation Context Recoveries - Recovers a user's TGT by requesting a fake delegation context and extracting credentials.
• Credential Brute-Forcing - Creates processes with alternate credentials and performs brute-force attacks against Kerberos authentication.
• Bronze Bit Exploitations - Applies the Bronze Bit vulnerability to bypass delegation validation checks during service-for-user operations.
• Kerberos Ticket Event Monitors - Captures new Kerberos ticket events in real time by hooking into the Windows ETW provider for processing.
• Active Directory Exploitation - C# toolset for advanced Kerberos interaction and ticket manipulation.
• Credential and Access Tools - C# toolkit for Kerberos interaction and ticket-based attack execution.
• Credential and Data Extraction - Tool for performing Kerberos-based attacks and Active Directory manipulation.
• Credential Harvesting - Tool for Kerberos interaction and credential theft.
• Offensive Security Frameworks - A C# toolset for interacting with and abusing Kerberos protocols.
• Offensive Security Tools - Tool for Kerberos interaction and exploitation.
• Post Exploitation - Tool for Kerberos interaction and ticket manipulation.
• Post Exploitation Frameworks - Tool for Kerberos interaction and ticket manipulation.
• Security Tooling - Toolset for raw Kerberos interaction and ticket abuse.
• Windows Security Utilities - Tool for interacting with and abusing Kerberos tickets.

Star history