Researchers Refine Kerberos Diamond Ticket Forgery in Rubeus
Summary
Researchers enhanced Rubeus Diamond Ticket forgery with LDAP-derived PAC data, more Windows-like Kerberos exchanges, and service-ticket support. The technique still carries detection risks, including client-to-DC traffic that bypasses LSASS.
Key points
- Diamond Tickets modify legitimately issued Kerberos tickets rather than create them entirely from scratch; TGT modification requires the KRBTGT key.
- The original Rubeus proof of concept used default privileged group memberships and incomplete or incorrect PAC attributes, creating potential detection opportunities.
- The researchers added LDAP and SYSVOL integration to populate PAC fields with target-user attributes, actual group memberships, and domain policy data, demonstrating before-and-after differences.
- New /opsec support reproduces Windows-style two-step pre-authentication exchanges and enforces AES256 encryption and appropriate KDCOptions to reduce network-level discrepancies.
- The implementation extends Diamond forgery to service tickets using a supplied ticket and the service's AES key.
- The authors acknowledge remaining detection risk because Rubeus bypasses LSASS for client-to-domain-controller communication, and recommend correlating authentication patterns with communication anomalies.
Article Details
- Attack Vectors
- Diamond TGT forgery starts with a legitimate AS-REQ/AS-REP exchange, then decrypts, modifies, and re-encrypts the issued ticket using the KRBTGT AES256 key.
- The researchers added LDAP integration to populate forged PACs with actual user attributes, group memberships, account-control flags, and password-policy information collected from Active Directory and SYSVOL.
- The added /opsec option reproduces Windows' two-step pre-authentication exchange, enforces AES256, and adjusts KDCOptions to reduce network-level differences from legitimate authentication.
- The researchers extended Diamond forgery to service tickets using a legitimate or previously forged ticket and the service's AES key, retaining a genuine ticket-request exchange.
- Defensive Notes
- Monitor authentication patterns and client-to-domain-controller communication rather than relying exclusively on PAC contents.
- Correlate multiple indicators in SIEM rules; legitimate-looking AS or TGS exchanges do not establish that the resulting tickets are unmodified.
- The original proof of concept used default group RIDs 520,512,513,519,518 and incomplete or inconsistent PAC attributes that can expose forgery when defenders can decrypt and inspect the PAC.
- LDAP-populated PAC fields reduce the usefulness of checks for default groups, artificial extra SIDs, incorrect identity attributes, and inconsistent policy timestamps.
- The article identifies client-to-domain-controller communication that bypasses LSASS as a remaining detection opportunity, despite the LDAP and /opsec enhancements.
MITRE ATT&CK
T1069.002 · Domain GroupsRubeus retrieves actual domain group memberships through LDAP so forged PACs reflect the impersonated user's groups rather than predefined defaults.T1087.002 · Domain AccountRubeus queries Active Directory over LDAP for user identity and account attributes used to populate forged PACs.T1201 · Password Policy DiscoveryRubeus reads domain password-policy settings from GptTmpl.inf in SYSVOL, including password length, expiration, and lockout settings, to construct more consistent forged PAC data.T1558.001 · Golden TicketThe demonstrated Diamond TGT workflow uses the KRBTGT AES256 key to decrypt an issued TGT, alter its identity and PAC data, and re-encrypt it for impersonation and privilege escalation.T1558.002 · Silver TicketThe researchers extend Diamond forgery to service tickets by modifying tickets using the service's AES key, contrasting this approach with traditional Silver Tickets.
People
Andrew SchwartzAuthor of the research describing enhancements to Diamond Ticket forgery in Rubeus.Ceri CoburnCredited with reviewing the research post.Charlie ClarkCo-author, identified as @exploitph, of the Diamond Ticket research.Elad ShamirCredited with reviewing the post and previously pointing the researchers to Tim Medin's service-ticket research.Joe DibleyCredited with helping implement the /opsec function for Rubeus' Diamond action.Tim MedinHis DerbyCon 2014 talk is cited as discussing the same ticket-modification concept in the context of service tickets.
Products
Microsoft Active DirectoryKerberos tickets are at the heart of authentication and authorization in Active Directory (AD) environments. They ensure that users are properly authenticated before accessing network resources,Microsoft WindowsMARVEL.LOCAL domain. The term NT_PRINCIPAL signifies that it’s a standard NT (Windows) user principal.