[!] Unhandled Rubeus exception:

[Wolchara000]

Good day.
Trying to run Rubeus monitor. On all systems (Win10 and Win7) same issue. Tried at local Admin, Domain admin, User... Same. Tried disabling UAC.

PS C:\> .\Rubeus.exe monitor

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v1.5.0

[*] Action: TGT Monitoring
[*] Monitoring every 60 seconds for new TGTs


[!] Unhandled Rubeus exception:

System.Exception: Could not elevate to system
   в Rubeus.LSA.GetLsaHandle()
   в Rubeus.LSA.EnumerateTickets(Boolean extractTicketData, LUID targetLuid, String targetService, String targetUser, St
ring targetServer, Boolean includeComputerAccounts, Boolean silent)
   в Rubeus.Harvest.HarvestTicketGrantingTickets()
   в Rubeus.Commands.Monitor.Execute(Dictionary`2 arguments)
   в Rubeus.Domain.CommandCollection.ExecuteCommand(String commandName, Dictionary`2 arguments)
   в Rubeus.Program.MainExecute(String commandName, Dictionary`2 parsedArgs)
PS C:\>

[HarmJ0y]

So it's failing at the Helpers.GetSystem() call (https://github.com/GhostPack/Rubeus/blob/master/Rubeus/lib/Helpers.cs#L82-L134) . For some reason the token duplication method to elevate to SYSTEM is failing. This can occasionally happen in some situations where SeDebugPrivilege is removed from local administrators, but without the system to experiment with it's hard to tell.

Can you try to elevate to SYSTEM manually (i.e. with PSEXEC) and try running the same Rubeus command while running from that context?

[Wolchara000]

Ok. Done.
From "nt authority\system" it works fine.
Strange. I used clean Win 10 distr. + DC 2012R2 clean with domain as test environment. On both systems it didn't get monitor mode.

`C:>whoami
nt authority\system

C:>Rubeus.exe monitor

---

(_____ \ | |
) ) | | _____ _ _ ___
| __ /| | | | _ | ___ | | | |/)
| | \ | || | |) ) | || | |
|| ||/|/|_____)_/(/

v1.5.0

[] Action: TGT Monitoring
[] Monitoring every 60 seconds for new TGTs

[*] 15.04.2020 9:39:06 UTC - Found new TGT:

User : ivanov@THUNTER.LOCAL
StartTime : 15.04.2020 10:44:00
EndTime : 15.04.2020 20:44:00
RenewTill : 22.04.2020 10:44:00
Flags : name_canonicalize, pre_authent, initial, renewable, forwardable
Base64EncodedTicket :

doIFLDCCBSigAwIBBaEDAgEWooIEMDCCBCxhggQoMIIEJKADAgEFoQ8bDVRIVU5URVIuTE9DQUyiIjAgoAMCAQKhGTAXGwZrcmJ0`