rubeus_asktgs
Request service tickets (TGS) for specified Service Principal Names (SPNs) using a valid TGT. Supports multiple SPNs, encryption types, and pass-the-ticket.
Instructions
Request Service Tickets (TGS) for specified Service Principal Names (SPNs).
Requires a valid TGT (provided as ticket parameter or from current session). Can request tickets for multiple SPNs in one operation.
Use cases:
Access specific services after obtaining TGT
Kerberoasting alternative (request specific SPN tickets)
S4U2Self/S4U2Proxy prerequisite
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ticket | No | Base64 encoded TGT or path to .kirbi file | |
| service | Yes | Target SPN(s), comma-separated for multiple | |
| domain | No | Target domain | |
| dc | No | Domain controller IP/hostname | |
| outfile | No | Output file for ticket | |
| ptt | No | Pass-the-ticket to current session | |
| nowrap | No | Don't wrap base64 output | |
| enctype | No | Preferred encryption type | |
| opsec | No | Use OPSEC-safe options | |
| enterprise | No | Enterprise principal name format | |
| u2u | No | User-to-User authentication | |
| targetuser | No | Target user for U2U | |
| tgs | No | Provide TGS for renewal | |
| servicekey | No | Service key for decryption | |
| asrepkey | No | AS-REP key for decryption | |
| keylist | No | Request using key list |