rubeus_s4u
Perform S4U2Self and S4U2Proxy attacks to obtain service tickets for impersonated users, enabling privilege escalation when you control an account with delegation rights.
Instructions
Perform S4U (Service for User) constrained/unconstrained delegation abuse.
Implements:
S4U2Self: Obtain service ticket to yourself on behalf of another user
S4U2Proxy: Use constrained delegation to obtain ticket to target service
This is a powerful technique for privilege escalation when you control an account with delegation rights.
Supports:
User-based authentication (password/hash)
Ticket-based authentication
Bronze Bit exploitation (CVE-2020-17049)
OPSEC-safe options
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| user | No | Account with delegation rights | |
| domain | No | Domain name | |
| rc4 | No | RC4/NTLM hash of delegating account | |
| aes256 | No | AES256 key of delegating account | |
| aes128 | No | AES128 key of delegating account | |
| ticket | No | TGT of delegating account | |
| impersonateuser | Yes | User to impersonate | |
| msdsspn | No | Target SPN for S4U2Proxy | |
| altservice | No | Alternative service(s) for SPN substitution | |
| dc | No | Domain controller IP/hostname | |
| outfile | No | Output file for ticket | |
| ptt | No | Pass-the-ticket to current session | |
| nowrap | No | Don't wrap base64 output | |
| self | No | Only perform S4U2Self | |
| opsec | No | Use OPSEC-safe options | |
| force | No | Force with non-AES256 keys | |
| bronzebit | No | Exploit CVE-2020-17049 | |
| nopac | No | Request ticket without PAC | |
| createnetonly | No | Program to spawn in netonly session | |
| s4uproxytarget | No | Final delegation target | |
| s4utransitedservices | No | Transited services for PAC | |
| targetdomain | No | Target domain if different | |
| targetdc | No | Target DC if different |