| name | active-directory-asreproasting |
| description | Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
|
| domain | cybersecurity |
| subdomain | penetration-testing |
| category | Network |
| difficulty | intermediate |
| estimated_time | 1-2 hours |
| mitre_attack | {"tactics":["TA0006"],"techniques":["T1558.004"]} |
| platforms | ["windows","linux"] |
| tags | ["active-directory","kerberos","asreproasting","rubeus","impacket","credential-access"] |
| tools | ["rubeus","impacket","hashcat","john-the-ripper"] |
| version | 1.0 |
| author | CyberSkills-Elite |
| license | Apache-2.0 |
Active Directory AS-REP Roasting
When to Use
- When performing external or internal enumeration and you DO NOT possess any valid Active Directory credentials (a completely unauthenticated position), but you have a list of valid usernames.
- When an administrator has misconfigured user accounts by checking the "Do not require Kerberos preauthentication" setting (often done for legacy Linux integrations or broken service wrappers).
- As a secondary, faster credential extraction method alongside Kerberoasting.
Prerequisites
- Network access to the target subnet (VPN, pivot, or direct connection)
- Nmap and relevant network scanning tools installed
- Understanding of TCP/IP, common protocols, and network segmentation
- Root/admin access on the attack machine for raw socket operations
Workflow
Phase 1: Understanding the Mechanism
# Concept: By default in Active Directory, when a user requests a Kerberos Ticket (TGT),
# they must prove they know their password by sending a timestamp encrypted with their password
# hash (this is Preauthentication).
# The Vulnerability: If "Do not require Kerberos preauthentication" is enabled on a user account,
# ANYONE on the network can ask the Domain Controller for a TGT for that user.
# The DC will happily bundle up the TGT, encrypt a portion of it with the user's password hash,
# and send it to the attacker.
# The attacker can then take this AS-REP (Authentication Service Response) offline and crack it.
Phase 2: Unauthenticated AS-REP Roasting (Impacket)
impacket-GetNPUsers CORP.LOCAL/ -no-pass -usersfile usernames.txt -format hashcat -dc-ip 192.168.1.100
Phase 3: Authenticated Discovery (Rubeus)
# Concept: If you ALREADY have compromised a low-level domain user, you don't need a wordlist.
# You can query LDAP explicitly for all misconfigured accounts and request the tickets automatically.
# 1. Execute Rubeus on a domain-joined machine.
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
# Rubeus queries LDAP for `userAccountControl` containing `DONT_REQ_PREAUTH` (Value 4194304).
# It requests the AS-REP for every single vulnerable account found and outputs to the text file.
Phase 4: Offline Cracking (Hashcat)
hashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -O
Decision Point 🔀
flowchart TD
A[Identify target Domain] --> B{Do you have ANY valid credentials?}
B -->|Yes| C[Execute `Rubeus asreproast` or `GetNPUsers` with credentials to query LDAP directly]
B -->|No| D[Gather OSINT/Username lists (e.g., LinkedIn scraping, SMB Null Sessions)]
D --> E[Execute `GetNPUsers` providing the username list and `-no-pass`]
C --> F[Extract AS-REP Hashes]
E --> F
F --> G[Crack offline using Hashcat module 18200]
G --> H[Password Recovered. Lateral Movement achieved.]
🔵 Blue Team Detection & Defense
- Audit UserAccountControl: Immediately identify and remediate any Active Directory accounts with the
DONT_REQ_PREAUTH flag enabled. Use PowerShell to audit the domain:
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True}. Disable this requirement entirely unless absolutely required by a specific legacy appliance.
- Enforce Complex Passwords: As with Kerberoasting, if preauthentication disabling is mandatory for a system to function, the associated account must be enforced to use a 30+ character random password to mathematically guarantee immunity against offline Hashcat dictionary attacks.
- Kerberos Anomaly Detection: Configure SIEM alerts (Windows Event ID 4768) if a single IP address systematically requests hundreds of TGT tickets for various accounts within seconds, behavior entirely disconnected from normal interactive logon flows.
Key Concepts
| Concept | Description |
|---|
| Preauthentication | A Kerberos defense mechanism requiring the requesting user to prove they know their password (by encrypting a timestamp) before the Domain Controller issues any tickets |
| AS-REP | Authentication Service Response; the message the KDC (Key Distribution Center) sends back to the client containing the Ticket Granting Ticket (TGT) |
| UAC Flags | UserAccountControl; a bitmask integer stored in Active Directory defining the security properties of a user account |
Output Format
Penetration Test Report: Unauthenticated Credential Extraction via AS-REP Roasting
==================================================================================
Tactic: Credential Access (T1558.004)
Severity: High (CVSS 8.1)
Target: `SVC_Jenkins` Account
Description:
During initial perimeter enumeration from an unauthenticated posture, the Red Team obtained a list of valid corporate usernames via OSINT gathering and metadata extraction from public PDFs.
Utilizing Impacket's `GetNPUsers` module across the unauthenticated network boundary targeting the internal Domain Controller, it was discovered that the `SVC_Jenkins` account had been explicitly configured to disable Kerberos Preauthentication (`DONT_REQ_PREAUTH`).
The attack successfully requested the AS-REP message, allowing the offline extraction of the Kerberos Ticket. Utilizing a dictionary-based attack on GPU infrastructure, the associated NTLM password (`DevOpsRulez123`) was cracked in 45 seconds.
Impact:
The attacker transitioned from a black-box, unauthenticated state to possessing fully valid domain credentials without generating login failure alerts on the Domain Controller. The compromised Service Account permitted read access to source code repositories.
🛡️ Remediation & Mitigation Strategy
- Input Validation: Sanitize and strictly type-check all inputs.
- Least Privilege: Constrain component execution bounds.
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
References
