AS-REPRoasting
AS-REPRoasting is an attack on the initial Kerberos authentication step and it is usually performed after obtaining a list of valid domain users.
Preauthentication is a security feature in Kerberos where the client must prove knowledge of their password before the KDC issues a TGT. This is done by encrypting a timestamp with a key derived from the user’s password and sending it to the KDC. If the KDC can decrypt and validate the timestamp, it confirms the user knows their password — protecting against offline brute-force attacks.
If an account has the Do not require Kerberos pre-authentication setting enabled then everyone can request from the DC to authenticate as that account and receive an AS-REP. The AS-REP contains the TGT which is encypted with the account's password hash which can be potentially cracked.
Tools
Enumerate ASREPRoastable accounts using Impacket or Kerbrute:
Execute the attack using Impacket or NetExec:
For an example of ASREPRoasting using nxc see Sauna.
Enumerate ASREPRoastable accounts using PowerView or the ActiveDirectory module:
Execute the attack using Rubeus:
OPSEC: Try to attack a single user at a time as this is not seen as an anomaly and won't trigger alerts.
The obtained hashes can be cracked using Hashcat or JtR:
Targeted AS-REPRoast
If we can't find any vulnerable users, but we have GenericWrite or GenericAll on a user object, we can modify that user's UserAccountControl to disable preauthentication and then perform the ASREP roast attack. Don't forget to reset the UserAccountControl after extraction!
Resources
What
impacket-GetNPUsersdoes behind the scenes (video)
Last updated
Was this helpful?