[!] Unhandled Rubeus exception: about rubeus HOT 2 CLOSED

So it's failing at the Helpers.GetSystem() call (https://github.com/GhostPack/Rubeus/blob/master/Rubeus/lib/Helpers.cs#L82-L134) . For some reason the token duplication method to elevate to SYSTEM is failing. This can occasionally happen in some situations where SeDebugPrivilege is removed from local administrators, but without the system to experiment with it's hard to tell.

Can you try to elevate to SYSTEM manually (i.e. with PSEXEC) and try running the same Rubeus command while running from that context?

from rubeus.

Ok. Done.
From "nt authority\system" it works fine.
Strange. I used clean Win 10 distr. + DC 2012R2 clean with domain as test environment. On both systems it didn't get monitor mode.

`C:>whoami
nt authority\system

C:>Rubeus.exe monitor

(_____ \ | |
) ) | | _____ _ _ ___
| __ /| | | | _ | ___ | | | |/)
| | \ | || | |) ) | || | |
|| ||/|/|_____)_/(/

v1.5.0

[] Action: TGT Monitoring
[] Monitoring every 60 seconds for new TGTs

[*] 15.04.2020 9:39:06 UTC - Found new TGT:

User : [email protected]
StartTime : 15.04.2020 10:44:00
EndTime : 15.04.2020 20:44:00
RenewTill : 22.04.2020 10:44:00
Flags : name_canonicalize, pre_authent, initial, renewable, forwardable
Base64EncodedTicket :

doIFLDCCBSigAwIBBaEDAgEWooIEMDCCBCxhggQoMIIEJKADAgEFoQ8bDVRIVU5URVIuTE9DQUyiIjAgoAMCAQKhGTAXGwZrcmJ0`

from rubeus.