Rubeus on MrAzoth

Kerberos Attacks — From Kali

Mon, 01 Jan 0001 00:00:00 +0000

Quick Reference

Attack	Tool	Hashcat Mode	Requirement
AS-REP Roasting	GetNPUsers.py / kerbrute	-m 18200	DONT_REQ_PREAUTH flag set
Kerberoasting	GetUserSPNs.py	-m 13100 (RC4) / -m 19700 (AES)	Valid domain user + SPN exists
Pass-the-Ticket	getTGT.py + impacket	N/A	Valid credentials or hash
Overpass-the-Hash	getTGT.py -aesKey	N/A	AES256 key for user
Kerbrute userenum	kerbrute	N/A	Network access to DC on port 88
Ticket conversion	ticket_converter.py	N/A	Existing .kirbi or .ccache

AS-REP Roasting

AS-REP Roasting targets accounts that have Kerberos pre-authentication disabled (DONT_REQ_PREAUTH flag set in userAccountControl). The KDC returns an AS-REP containing a portion encrypted with the user’s hash — no prior authentication required, making it requestable by anyone.

Kerberos Attacks — From Windows

Mon, 01 Jan 0001 00:00:00 +0000

Quick Reference

Attack	Tool	Prerequisite	Output
Kerberoasting	Rubeus, PowerView	Domain user, SPN exists	RC4/AES hash → offline crack
AS-REP Roasting	Rubeus	Domain user, pre-auth disabled on target	AS-REP hash → offline crack
Pass-the-Ticket	Rubeus, Mimikatz	Valid .kirbi or base64 ticket	Ticket injected into session
Overpass-the-Hash	Mimikatz, Rubeus	NTLM or AES hash	TGT obtained, ticket injected
Pass-the-Key	Mimikatz	AES256 hash	TGT obtained via AES pre-auth
Ticket Extraction	Rubeus, Mimikatz	Local admin (for other users’ tickets)	.kirbi files / base64 tickets
TGT Delegation	Rubeus tgtdeleg	Domain user, no local admin needed	Usable TGT
Ticket Harvesting	Rubeus harvest/monitor	Local admin	Ongoing TGT collection
Unconstrained Delegation Abuse	Rubeus monitor + coerce	Local admin on delegation host	Victim TGT captured

Hashcat Cracking Modes Reference

Mode	Hash Type	Attack Context
13100	Kerberoast — RC4 (TGS-REP)	Kerberoasting with /rc4opsec
19600	Kerberoast — AES128 (TGS-REP)	Kerberoasting with /aes
19700	Kerberoast — AES256 (TGS-REP)	Kerberoasting with /aes
18200	AS-REP — RC4 (krb5asrep)	AS-REP Roasting
17200	DPAPI masterkey	Seatbelt / Mimikatz DPAPI
1000	NTLM	Pass-the-Hash, secretsdump output
5600	NTLMv2 (Net-NTLMv2)	Responder / NTLM relay capture
7500	Kerberos 5 AS-REQ (etype 23)	Pre-auth brute force
3000	LM	Legacy — rarely seen

Kerberoasting

Kerberoasting requests Kerberos service tickets (TGS-REP) for accounts with a Service Principal Name (SPN) set. The ticket is encrypted with the service account’s password hash, enabling offline cracking.

Delegation Attacks — From Windows

Mon, 01 Jan 0001 00:00:00 +0000

Abusing Kerberos delegation (Unconstrained, Constrained, RBCD, Shadow Credentials) from a Windows foothold using Rubeus, PowerView, and PowerMad.

Domain & Forest Trusts — From Windows

Mon, 01 Jan 0001 00:00:00 +0000

Enumerating and exploiting Active Directory domain and forest trusts from a Windows foothold: SID history injection, golden ticket cross-domain, inter-realm key abuse.

Persistence — From Windows

Mon, 01 Jan 0001 00:00:00 +0000

Domain persistence techniques after AD compromise: Golden/Silver/Diamond Tickets, DCSync backdoors, AdminSDHolder, ACL abuse, WMI subscriptions, and DPAPI backup keys.

AD CS Attacks — From Windows

Mon, 01 Jan 0001 00:00:00 +0000

Active Directory Certificate Services exploitation from Windows: ESC1-ESC8 with Certify, ForgeCert, Rubeus, and Pass-the-Certificate.