Rubeus
Introduction
One fault of Mimikatz is that it obtains handles to sensitive resources (SAM, LSASS, etc.) and can be audited easily. Rubeus, uses legitimate Windows API to obtain it's information about the host.
Rubeus Credential Commands
Triage
Rubeus' triage command lists all Kerberos tickets in the current logon session. If run with elevated privileges, it will list logon sessions on the machine.
Dump
Rubeus' dump command will dump the tickets from memory. If not elevated, we can only pull our current session. We need to pass /luid and /service parameters (found in triage command).
This will output the tickets in base64 format. We can add the /nowrap parameter for easy copy / paste.
Last updated