Hey there.
Welcome to our lab environment. First,
I want to show you how to compile the Rubeus tool.
If you take a look at the GitHub page,
you note that the developers do not provide the binaries. Instead, you have
to download the source code and compile it yourself, but don't worry about
this. Compiling the code is not as complicated as it sounds, and I will
show you how to do that in this demo.
In here, I have a Windows machine with Visual Studio 2019 Community
Edition, and this is a free version of Visual Studio. Also,
I have the .NET Framework version 3.5 installed.
Also,
just to make sure everything works, I'll disable the Windows Defender antivirus
because it might detect the source code as a hacking tool.
Also, to save us some time, I already entered on the Rubeus GitHub and
downloaded the source code using this button here.
After the download, I extracted the folder to my desktop,
which is this one here.
Okay, so the process to compile is really simple.
First, let's open Visual Studio. And then, from here,
let's click on Open a project or solution.
Then, I'll navigate to the Rubeus source code folder and then
select this file here called Rubeus.sln.
Perfect. In here, I'll just go to the menu, Build, and then
clicking Build Solution, and that's about it.
A few moments later,
you see this message here saying it was successful. And if for
some reason the build was not successful,
make sure your antivirus is disabled, otherwise you
always fail. Once this code is compiled,
the executable file was saved inside this project folder.
We can find them inside of the bin folder and then the debug folder.
See here, this Rubeus.exe is the file that we're interested in. Just to
make sure that this is working, I'll open the terminal,
go to the folder where the exe is located, and then simply
run it to make sure it's working. Perfect.
Take a look, it is working.
So now, your job is to transfer this executable file
to your victim computer. Again,
this is a computer that is compromised and is a part of a domain.
So, let me log into my victim computer. Here we are.
This is the victim computer. Basically, this is a Windows
machine connected to the Globomantics domain.
As you can see, I already have here on my desktop the Rubeus executable.
Also, keep in mind, just for the purpose of this demo,
I disabled the antivirus on this computer.
In your case, in a real red team engagement,
you can try to modify the Rubeus source code before compiling
it to try to bypass antivirus detection.
Also, I'm connected to this machine as a low‑level user.
Take a look.
I'm using this user called ricardoreimao, and I can use this
command, net user, to show my privilege here.
As you can see, I'm just a regular domain user, nothing fancy. So okay,
we talked a lot, but no privilege escalation so far.
So, let's do this. First, I'll go to the desktop folder
and ensure that the Rubeus is working.
Then, it works fine.
Now, let me clear the screen, and then let's use Rubeus to perform a
kerberoasting attack. For that, it is really simple.
I'll use Rubeus.exe, and then the attack that I want to perform,
which is kerberoasting.
Then, I'll use the flag /format to indicate that I want the
hashes to be displayed in the hashcat format.
If you're not familiar,
hashcat is a tool for cracking hashes offline, and you'll
learn about that later in this demo.
Also,
I'll use the flag /outfile to specify the file name where the
hashes will be saved. And that's about it.
Once we run this, Rubeus will do all the heavy lifting for us.
We don't have to worry about creating Kerberos tickets or anything like that.
As you can see,
Rubeus was able to retrieve hashes for three accounts, the
Microsoft SQL 01, Microsoft SQL 02, and Microsoft SQL 03. And take
a look, if we open this file on the desktop,
we can see the hashes in there.
Pretty cool, right? Now,
all we have to do is crack those hashes offline to get the plain text
credentials for those accounts. And if you've never done this before,
don't worry. We'll do that in the next demo.