Skip to main content
Glama
Sign In
Rubeus MCP Server

Rubeus MCP Server

by schwarztim
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

Rubeus MCP Server

A Model Context Protocol (MCP) server for Kerberos abuse operations using Rubeus on Windows or Impacket on Linux/macOS.

Overview

This MCP server provides comprehensive tools for Kerberos-based security testing, wrapping the functionality of Rubeus (Windows) and Impacket (cross-platform) into a unified interface accessible through the Model Context Protocol.

Security Warning: This tool is intended for authorized security testing only. Unauthorized use against systems you do not own or have permission to test is illegal and unethical.

Related MCP server: Vulnerable MCP Server

Features

Ticket Operations

  • asktgt - Request Ticket Granting Tickets (TGT) using passwords, hashes, or certificates

  • asktgs - Request Service Tickets (TGS) for specific SPNs

  • renew - Renew existing TGTs to extend validity

  • ptt - Pass-the-ticket to apply tickets to current session

  • purge - Remove tickets from logon sessions

  • describe - Parse and analyze ticket contents

Roasting Attacks

  • kerberoast - Extract service account password hashes via TGS requests

  • asreproast - Attack accounts without Kerberos pre-authentication

Ticket Extraction

  • dump - Extract all tickets from memory

  • triage - Quick summary of available tickets

  • klist - Detailed ticket listing

  • harvest - Continuously monitor and harvest new TGTs

  • monitor - Watch for new TGT events

  • tgtdeleg - Extract TGT without elevation using delegation trick

Delegation Abuse

  • s4u - Perform S4U2Self/S4U2Proxy constrained delegation attacks

  • Bronze Bit exploitation (CVE-2020-17049)

Ticket Forgery

  • golden - Forge Golden Tickets with krbtgt hash

  • silver - Forge Silver Tickets with service account hash

  • diamond - Forge Diamond Tickets (modified legitimate TGT)

Utilities

  • hash - Calculate Kerberos password hashes (RC4, AES128, AES256, DES)

  • changepw - Change user passwords using TGT

  • createnetonly - Create processes with different network credentials

  • tgssub - Substitute service names in tickets

Installation

Prerequisites

Windows (Native Rubeus):

  • Download Rubeus.exe from GhostPack

  • .NET Framework 4.0+

Linux/macOS (Impacket):

pip install impacket

Setup

# Clone the repository
git clone https://github.com/schwarztim/sec-rubeus-mcp.git
cd sec-rubeus-mcp

# Install dependencies
npm install

# Build
npm run build

Configuration

Configure via environment variables:

Variable

Description

Default

RUBEUS_PATH

Path to Rubeus.exe (Windows)

Rubeus.exe

IMPACKET_PATH

Path to impacket scripts

System PATH

RUBEUS_OUTPUT_DIR

Directory for output files

$TMPDIR/rubeus-mcp

RUBEUS_DOMAIN

Default AD domain

None

RUBEUS_DC

Default domain controller

None

RUBEUS_TIMEOUT

Command timeout (ms)

300000

RUBEUS_USE_IMPACKET

Force impacket mode

Auto-detected

Usage with Claude Desktop

Add to your Claude Desktop configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "rubeus": {
      "command": "node",
      "args": ["/path/to/sec-rubeus-mcp/dist/index.js"],
      "env": {
        "RUBEUS_DOMAIN": "corp.example.com",
        "RUBEUS_DC": "dc01.corp.example.com"
      }
    }
  }
}

Usage with Claude Code

Add to your MCP configuration:

{
  "rubeus": {
    "command": "node",
    "args": ["/path/to/sec-rubeus-mcp/dist/index.js"],
    "env": {
      "RUBEUS_DOMAIN": "corp.example.com"
    }
  }
}

Examples

Check Environment

Use rubeus_check_environment to verify your setup

Request a TGT

Use rubeus_asktgt with:
- user: "admin"
- domain: "corp.example.com"
- password: "Password123"

Kerberoasting

Use rubeus_kerberoast with:
- domain: "corp.example.com"
- outfile: "hashes.txt"

AS-REP Roasting

Use rubeus_asreproast with:
- domain: "corp.example.com"
- format: "hashcat"

S4U Delegation Attack

Use rubeus_s4u with:
- user: "svc_account"
- rc4: "<ntlm_hash>"
- impersonateuser: "Administrator"
- msdsspn: "cifs/fileserver.corp.example.com"

Cross-Platform Support

Feature

Windows (Rubeus)

Linux/macOS (Impacket)

asktgt

Full

Full

asktgs

Full

Full

kerberoast

Full

Full

asreproast

Full

Full

s4u

Full

Full

dump

Full

Via secretsdump

Golden/Silver tickets

Full

Limited

Ticket manipulation

Full

Limited

Development

# Watch mode for development
npm run dev

# Build
npm run build

# Run tests
npm test

Security Considerations

  • All tools require appropriate authorization before use

  • Output files may contain sensitive data (tickets, hashes)

  • Credentials are not logged, but ticket data may be captured

  • Use in isolated test environments when possible

  • Follow responsible disclosure practices

License

MIT License - see LICENSE file for details.

Acknowledgments

Disclaimer

This tool is provided for educational and authorized security testing purposes only. The authors are not responsible for misuse or damage caused by this tool. Always obtain proper authorization before testing systems you do not own.

Available Tools

27 tools
rubeus_asktgsA

Request Service Tickets (TGS) for specified Service Principal Names (SPNs).

Requires a valid TGT (provided as ticket parameter or from current session). Can request tickets for multiple SPNs in one operation.

Use cases:

  • Access specific services after obtaining TGT

  • Kerberoasting alternative (request specific SPN tickets)

  • S4U2Self/S4U2Proxy prerequisite

Inputs: service (required), ticket, domain, dc, +12 more.

rubeus_asktgtA

Request a Ticket Granting Ticket (TGT) using user credentials.

Supports multiple authentication methods:

  • Password-based (cleartext or encrypted)

  • Hash-based (RC4/NTLM, AES128, AES256, DES)

  • Certificate-based (PKINIT)

The TGT can be saved to a file, applied to the current session (PTT), or returned as base64.

Example use cases:

  • Obtain TGT for lateral movement

  • Test credential validity

  • Support subsequent ticket operations

Inputs: user (required), domain, password, rc4, +13 more.

rubeus_asrep2kirbiB

Convert an AS-REP response to kirbi ticket format.

Takes a raw AS-REP response and converts it to a usable kirbi ticket using the provided key.

Inputs: asrep (required), key, keyhex, enctype, +4 more.

rubeus_asreproastB

Perform AS-REP Roasting against accounts that don't require pre-authentication.

Targets accounts with "Do not require Kerberos preauthentication" enabled. The AS-REP response contains data encrypted with the user's password hash.

Features:

  • Target specific users or enumerate vulnerable accounts

  • Output in hashcat or John format

  • OU-based targeting

Output format: hashcat mode 18200 or John (jumbo).

Inputs: user, domain, dc, ou, +8 more.

rubeus_changepwA

Change/reset a user's password using a TGT.

Uses the Kerberos Set Password protocol (Aorato technique) to change a user's password with just their TGT.

Can target other users with appropriate permissions.

Inputs: ticket (required), new (required), dc, targetuser, +1 more.

rubeus_check_environmentA

Check the current environment and available tools.

Detects whether running on Windows (native Rubeus) or Linux/macOS (impacket mode). Lists available tools and configuration.

Inputs: no named parameters.

rubeus_createnetonlyA

Create a new process with network credentials (logon type 9).

Creates a process that uses different credentials for network authentication. Useful for applying tickets to a separate process.

The process can be hidden or visible.

Inputs: program (required), show, ticket, domain, +2 more.

rubeus_currentluidA

Display the current user's Logon Unique ID (LUID).

Returns the LUID of the current logon session, which is needed for various ticket operations.

Inputs: no named parameters.

rubeus_describeA

Parse and display detailed information about a Kerberos ticket.

Can decrypt ticket contents if the appropriate key is provided. Useful for analyzing captured tickets.

Inputs: ticket (required), servicekey, krbkey, asrepkey, +2 more.

rubeus_diamondA

Forge a Diamond Ticket (modified legitimate TGT).

Requests a legitimate TGT and then modifies it with new PAC data. More stealthy than golden tickets as it starts with a real ticket.

Requires krbtgt key for re-signing.

Inputs: domain (required), krbkey (required), user, password, +14 more.

rubeus_dumpA

Dump all Kerberos tickets from memory (current or all sessions).

Extracts tickets from the current logon session or, with elevation, from all logon sessions on the system.

Tickets are output as base64-encoded kirbi format.

Inputs: luid, user, service, server, +1 more.

rubeus_goldenA

Forge a Golden Ticket (forged TGT with krbtgt hash).

Creates a TGT that grants domain-wide access. Requires:

  • Domain SID

  • krbtgt account hash (RC4 or AES)

  • Target username and domain

The golden ticket bypasses normal authentication and can be used for persistent domain access.

Inputs: user (required), domain (required), sid, rc4, +17 more.

rubeus_harvestB

Continuously monitor for and harvest new TGTs.

Runs in a loop, extracting new TGTs as they appear and optionally auto-renewing them to maintain access.

Useful for capturing tickets from other users logging in.

Inputs: monitorinterval, displayinterval, targetuser, nowrap, +2 more.

rubeus_hashA

Calculate Kerberos password hashes from plaintext.

Computes the various Kerberos encryption keys from a password:

  • RC4_HMAC (NTLM)

  • AES128_CTS_HMAC_SHA1

  • AES256_CTS_HMAC_SHA1

  • DES_CBC_MD5

These hashes can be used for ticket requests and other operations.

Inputs: password (required), user, domain.

rubeus_kerberoastA

Perform Kerberoasting attack to extract service account password hashes.

Requests TGS tickets for accounts with SPNs, which are encrypted with the service account's password hash. These can be cracked offline.

Features:

  • Target specific users or all SPN accounts

  • AES vs RC4 OPSEC considerations

  • Statistics mode for reconnaissance

  • LDAP filtering for targeted attacks

  • Password age filtering

Output format compatible with hashcat (mode 13100/19700) or John.

Inputs: domain, dc, user, spn, +19 more.

rubeus_kirbiB

Modify a kirbi ticket's session key.

Changes the session key in an existing kirbi ticket. Useful for advanced ticket manipulation.

Inputs: kirbi (required), sessionkey (required), sessionetype, ptt, +3 more.

rubeus_klistA

List detailed information about Kerberos tickets.

Similar to the native klist command but with more detail and filtering options.

Inputs: luid, user, service, server.

rubeus_logonsessionC

Display information about logon sessions.

Shows detailed information about the current or specified logon session.

Inputs: current, luid.

rubeus_monitorA

Monitor for new TGTs without harvesting/renewal.

Watches for new TGT events and displays them as they occur. Lighter weight than harvest - just observation.

Inputs: interval, targetuser, nowrap, registry, +1 more.

rubeus_pttA

Pass-the-ticket: Apply a Kerberos ticket to the current logon session.

Imports a ticket (from base64 or .kirbi file) into the current session, enabling access to resources as the ticket's principal.

Inputs: ticket (required), luid.

rubeus_purgeA

Purge Kerberos tickets from a logon session.

Removes all tickets from the current session, or with elevation, from a specific LUID.

Inputs: luid.

rubeus_renewA

Renew an existing TGT to extend its validity period.

Can optionally auto-renew continuously until the renewable lifetime expires. Useful for maintaining persistent access without re-authentication.

Inputs: ticket (required), dc, outfile, ptt, +2 more.

rubeus_s4uA

Perform S4U (Service for User) constrained/unconstrained delegation abuse.

Implements:

  • S4U2Self: Obtain service ticket to yourself on behalf of another user

  • S4U2Proxy: Use constrained delegation to obtain ticket to target service

This is a powerful technique for privilege escalation when you control an account with delegation rights.

Supports:

  • User-based authentication (password/hash)

  • Ticket-based authentication

  • Bronze Bit exploitation (CVE-2020-17049)

  • OPSEC-safe options

Inputs: impersonateuser (required), user, domain, rc4, +19 more.

rubeus_silverA

Forge a Silver Ticket (forged TGS with service account hash).

Creates a service ticket for a specific service. Requires:

  • Service account hash

  • Service SPN

  • Domain information

Silver tickets grant access to a specific service without touching the DC.

Inputs: user (required), domain (required), service (required), id, +16 more.

rubeus_tgssubA

Substitute the service name in a service ticket.

Replaces the SPN in an existing TGS with a different service name. Useful when you have a ticket for one service but need access to another on the same server (requires same service account).

Inputs: ticket (required), altservice (required), srealm, ptt, +2 more.

rubeus_tgtdelegA

Extract a usable TGT for the current user without elevation.

Uses Kerberos GSS-API to abuse the delegation mechanism and retrieve the current user's TGT. This is the "tgt::deleg" technique from Kekeo.

No admin/elevation required - works with standard user permissions. The extracted TGT can be used for pass-the-ticket attacks.

Inputs: target, nowrap.

rubeus_triageA

Display a quick summary of all tickets in current/all sessions.

Shows ticket information without full extraction - useful for reconnaissance of what tickets are available.

Inputs: luid, user, service, server.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.5/5.0

    Scored across 27 tools

    Disambiguation3/5

    Several tools operate on tickets from memory (dump, harvest, monitor, triage, klist) and multiple forging tools exist (golden, diamond, silver), so there is real overlap in purpose. The detailed descriptions clarify the differences, but an agent could still misselect between similarly scoped options.

    Naming Consistency4/5

    All tools share a consistent rubeus_ prefix and lowercase snake_case format. The naming is predictable, but minor deviations exist: check_environment uses an underscore where other multiword commands are concatenated (e.g., createnetonly, currentluid), and some names are nouns rather than verbs.

    Tool Count3/5

    27 tools is above the typical MCP range and several are niche support operations (currentluid, logonsession, check_environment). However, the count reflects the breadth of the underlying Rubeus command set and each tool maps to a distinct capability, so it is borderline rather than excessive.

    Completeness5/5

    The tool surface covers the full offensive Kerberos lifecycle: authentication, ticket requests, roasting, delegation, extraction, monitoring, forging, ticket manipulation, renewal, pass-the-ticket, and purging. There are no obvious missing operations that would create dead ends for common workflows.

    Resources

    Related MCP Connectors

    Related MCP Servers

    • sliver-mcp

      v0idravl
      A
      license
      B
      quality
      C
      maintenance
      A Model Context Protocol server for the Sliver C2 framework that exposes operator tools like listeners, implant generation, sessions, command execution, and file operations for LLM-driven adversary emulation.
      37
      1
      MIT