Overview of Rubeus createnetonly

The createnetonly action will use the CreateProcessWithLogonW() API to create a new hidden (unless /show is specified) process with a SECURITY_LOGON_TYPE of 9 (NewCredentials), the equivalent of runas /netonly. The process ID and LUID (logon session ID) are returned. This process can then be used to apply specific Kerberos tickets to with the ptt /luid:0xA.. parameter, assuming elevation. This prevents the erasure of existing TGTs for the current logon session.

References

• https://github.com/GhostPack/Rubeus#createnetonly

Request Access to Use Case Repository

Tags

Defense Evasion

Privilege Escalation

Credential Access

Splunk

Kerberoasting

Steal or Forge Kerberos Tickets