TGTDeleg
This module builds upon the SessionExec module. Whereby, execution on a remote host will perform a TGTDeleg operation from Rubeus under each user logon on the remote system.
For example, assuming the below output. We can see the remote host currently has the users standarduser and srv2019-admin within existing logon sessions. PsMapExec will perform Rubeus' TGTDeleg command as each user and obtain a usable TGT.
Output for TGTDeleg is stored $PWD\PME\TGTDeleg\.
Optional Parameters
-NoParse
N/A
If specified, PsMapexec will not parse the ticket output.
-ShowOutput
N/A
Displays each targets output to the console
-SuccessOnly
N/A
Display only successful results
Usage
Parsing
PsMapExec will parse the results from each system and present the results in a digestible and readable format. The notes field will highlight in yellow any interesting information about each result. Additionally, the output will generate easy one liner commands to run to impersonate the user.
The table below shows the possible values for the notes field.
AdminCount=1
Identifies an account that may hold privileged permissions within the domain
Domain Admin, Enterprise Admin, Server Operator, Account Operator
The account is a member of one of these privileged groups
Last updated
Was this helpful?
