By @tifkin_ and @Ne0nd0g's request, just pushed a "triage" command to let you easily triage servers with a lot of tickets. Can filter by /luid:X, /user:USER, or /service:KRBTGT github.com/GhostPack/Rubeus#… . Less detail than the "klist" cmd, but easier to handle for lots of results

6:22 PM · Feb 7, 2019

1
72
154
So "triage" is useful for a first pass (though only works elevated), "klist" if you want more details (works elevated or not), and "dump" if you want ticket blobs 👍
1
0
2