WEBVTT

00:00:01.440 --> 00:00:02.000
Hey there.

00:00:02.009 --> 00:00:04.650
Welcome to our lab environment. First,

00:00:04.660 --> 00:00:07.260
I want to show you how to compile the Rubeus tool.

00:00:07.940 --> 00:00:09.930
If you take a look at the GitHub page,

00:00:10.000 --> 00:00:14.690
you note that the developers do not provide the binaries. Instead, you have

00:00:14.690 --> 00:00:19.490
to download the source code and compile it yourself, but don't worry about

00:00:19.490 --> 00:00:23.430
this. Compiling the code is not as complicated as it sounds, and I will

00:00:23.430 --> 00:00:24.960
show you how to do that in this demo.

00:00:26.140 --> 00:00:30.550
In here, I have a Windows machine with Visual Studio 2019 Community

00:00:30.550 --> 00:00:35.920
Edition, and this is a free version of Visual Studio. Also,

00:00:35.930 --> 00:00:39.250
I have the .NET Framework version 3.5 installed.

00:00:40.640 --> 00:00:41.100
Also,

00:00:41.110 --> 00:00:45.030
just to make sure everything works, I'll disable the Windows Defender antivirus

00:00:45.040 --> 00:00:48.160
because it might detect the source code as a hacking tool.

00:00:49.640 --> 00:00:53.620
Also, to save us some time, I already entered on the Rubeus GitHub and

00:00:53.620 --> 00:00:56.060
downloaded the source code using this button here.

00:00:57.140 --> 00:01:00.230
After the download, I extracted the folder to my desktop,

00:01:00.320 --> 00:01:01.360
which is this one here.

00:01:02.940 --> 00:01:06.150
Okay, so the process to compile is really simple.

00:01:06.940 --> 00:01:11.790
First, let's open Visual Studio. And then, from here,

00:01:11.800 --> 00:01:14.360
let's click on Open a project or solution.

00:01:16.040 --> 00:01:20.870
Then, I'll navigate to the Rubeus source code folder and then

00:01:20.880 --> 00:01:24.760
select this file here called Rubeus.sln.

00:01:28.340 --> 00:01:32.120
Perfect. In here, I'll just go to the menu, Build, and then

00:01:32.120 --> 00:01:35.360
clicking Build Solution, and that's about it.

00:01:36.140 --> 00:01:37.140
A few moments later,

00:01:37.150 --> 00:01:41.380
you see this message here saying it was successful. And if for

00:01:41.380 --> 00:01:43.570
some reason the build was not successful,

00:01:43.680 --> 00:01:46.910
make sure your antivirus is disabled, otherwise you

00:01:46.910 --> 00:01:50.770
always fail. Once this code is compiled,

00:01:50.780 --> 00:01:53.860
the executable file was saved inside this project folder.

00:01:54.540 --> 00:01:58.760
We can find them inside of the bin folder and then the debug folder.

00:01:59.940 --> 00:02:05.150
See here, this Rubeus.exe is the file that we're interested in. Just to

00:02:05.150 --> 00:02:07.660
make sure that this is working, I'll open the terminal,

00:02:08.440 --> 00:02:12.290
go to the folder where the exe is located, and then simply

00:02:12.290 --> 00:02:17.430
run it to make sure it's working. Perfect.

00:02:17.430 --> 00:02:18.460
Take a look, it is working.

00:02:18.940 --> 00:02:22.090
So now, your job is to transfer this executable file

00:02:22.100 --> 00:02:24.520
to your victim computer. Again,

00:02:24.530 --> 00:02:27.760
this is a computer that is compromised and is a part of a domain.

00:02:28.940 --> 00:02:34.270
So, let me log into my victim computer. Here we are.

00:02:34.280 --> 00:02:37.420
This is the victim computer. Basically, this is a Windows

00:02:37.420 --> 00:02:39.760
machine connected to the Globomantics domain.

00:02:40.940 --> 00:02:44.860
As you can see, I already have here on my desktop the Rubeus executable.

00:02:45.940 --> 00:02:48.820
Also, keep in mind, just for the purpose of this demo,

00:02:48.830 --> 00:02:51.160
I disabled the antivirus on this computer.

00:02:51.640 --> 00:02:54.200
In your case, in a real red team engagement,

00:02:54.330 --> 00:02:57.680
you can try to modify the Rubeus source code before compiling

00:02:57.680 --> 00:03:00.060
it to try to bypass antivirus detection.

00:03:01.040 --> 00:03:04.250
Also, I'm connected to this machine as a low‑level user.

00:03:05.040 --> 00:03:05.580
Take a look.

00:03:05.590 --> 00:03:10.170
I'm using this user called ricardoreimao, and I can use this

00:03:10.170 --> 00:03:13.360
command, net user, to show my privilege here.

00:03:15.240 --> 00:03:20.140
As you can see, I'm just a regular domain user, nothing fancy. So okay,

00:03:20.140 --> 00:03:22.750
we talked a lot, but no privilege escalation so far.

00:03:23.240 --> 00:03:26.810
So, let's do this. First, I'll go to the desktop folder

00:03:26.950 --> 00:03:29.060
and ensure that the Rubeus is working.

00:03:30.640 --> 00:03:31.770
Then, it works fine.

00:03:32.010 --> 00:03:36.910
Now, let me clear the screen, and then let's use Rubeus to perform a

00:03:36.910 --> 00:03:40.680
kerberoasting attack. For that, it is really simple.

00:03:40.950 --> 00:03:46.550
I'll use Rubeus.exe, and then the attack that I want to perform,

00:03:47.040 --> 00:03:48.660
which is kerberoasting.

00:03:49.840 --> 00:03:54.030
Then, I'll use the flag /format to indicate that I want the

00:03:54.030 --> 00:03:56.560
hashes to be displayed in the hashcat format.

00:03:57.340 --> 00:03:58.450
If you're not familiar,

00:03:58.460 --> 00:04:02.610
hashcat is a tool for cracking hashes offline, and you'll

00:04:02.610 --> 00:04:04.150
learn about that later in this demo.

00:04:05.440 --> 00:04:05.990
Also,

00:04:06.000 --> 00:04:10.700
I'll use the flag /outfile to specify the file name where the

00:04:10.700 --> 00:04:13.660
hashes will be saved. And that's about it.

00:04:14.140 --> 00:04:17.950
Once we run this, Rubeus will do all the heavy lifting for us.

00:04:18.540 --> 00:04:22.160
We don't have to worry about creating Kerberos tickets or anything like that.

00:04:24.840 --> 00:04:25.660
As you can see,

00:04:25.670 --> 00:04:29.590
Rubeus was able to retrieve hashes for three accounts, the

00:04:29.590 --> 00:04:36.350
Microsoft SQL 01, Microsoft SQL 02, and Microsoft SQL 03. And take

00:04:36.350 --> 00:04:38.690
a look, if we open this file on the desktop,

00:04:38.700 --> 00:04:40.260
we can see the hashes in there.

00:04:41.040 --> 00:04:42.530
Pretty cool, right? Now,

00:04:42.540 --> 00:04:46.690
all we have to do is crack those hashes offline to get the plain text

00:04:46.690 --> 00:04:50.520
credentials for those accounts. And if you've never done this before,

00:04:50.730 --> 00:04:53.050
don't worry. We'll do that in the next demo.