Rubeus tgtdeleg
Extract a usable TGT for the current user without elevation by abusing the GSS-API delegation flow. The cleanest way to grab a TGT from a low-priv shell — no LSASS touching, no admin needed.
- Tool
- Rubeus.exe
- Category
- Credential Attacks / Hash Dumping
- Platform
- windows
- Requires
- shell access
- Protocols
- KERBEROS
Syntax
Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.
Rubeus.exe tgtdeleg /nowrapExamples
Rubeus.exe tgtdeleg /nowrapTags
Related commands
- Impacket DPAPI Masterkey Decrypt DPAPI masterkey using user password to derive DPAPI encryption key
- Impacket Secrets Dump Dump hashes from remote Windows system (SAM, LSA, NTDS)
- Impacket Targeted DCSync (Single User) DCSync only one specific account instead of replicating the whole NTDS. Massively…
- Lsassy LSASS Dump Remotely dump LSASS credentials using lsassy
- Mimikatz Credential Dump Extract plaintext passwords and hashes from all available sources
- Mimikatz dpapi::masterkey Decrypt a DPAPI master key using the owner's plaintext password (or NT hash). Required…
- Mimikatz lsadump::dcsync Pull a single user's NT hash and Kerberos keys directly from a DC via the MS-DRSR…
- Mimikatz lsadump::sam Extract local SAM hashes (built-in Administrator, local users) from a live Windows host.…