| name | ad-asreproast-attack |
| description | Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component offline to recover plaintext credentials.
|
| domain | cybersecurity |
| subdomain | penetration-testing |
| category | Active Directory |
| difficulty | intermediate |
| estimated_time | 1-2 hours |
| mitre_attack | {"tactics":["TA0006"],"techniques":["T1558.004"]} |
| platforms | ["windows","active-directory"] |
| tags | ["active-directory","kerberos","asreproast","credential-access","impacket","hashcat"] |
| tools | ["impacket-GetNPUsers","hashcat","john-the-ripper","rubeus"] |
| version | 1.0 |
| author | CyberSkills-Elite |
| license | Apache-2.0 |
AS-REP Roasting Attack
When to Use
- During the early phases of an Active Directory penetration test when attempting to gain initial domain user access, or seeking to escalate privileges by cracking passwords of service or admin accounts.
- This attack does not require a valid domain user account to perform, only network access to the Domain Controller and a list of valid usernames. (Alternatively, if you have a domain account, you can automatically query LDAP for vulnerable users).
Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture
Workflow
Phase 1: Identifying Vulnerable Accounts (With Domain Access)
If you already have a low-privileged domain account, you can query LDAP to find accounts with DONT_REQ_PREAUTH enabled.
Phase 2: Targeted Extraction (Without Domain Access)
If you have a list of usernames but no domain credentials, you can attempt to roast them blindly against the Domain Controller.
Phase 3: Extracting Hashes from a Windows Host (Rubeus)
# Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
Phase 4: Offline Password Cracking
Extract the hashes from asrep_hashes.txt and run them through Hashcat.
Hashcat mode for AS-REP Roast is 18200 (Kerberos 5, etype 23, AS-REP).
Decision Point 🔀
flowchart TD
A[Identify AD Target ] --> B{Have Valid AD Credentials? ]}
B -->|Yes| C[LDAP Query DONT_REQ_PREAUTH ]
B -->|No| D[Brute Force Users List ]
C --> E[Extract & Crack Hash ]
D --> E
🔵 Blue Team Detection & Defense
- Audit Account Policies: Monitor Kerberos Event ID 4768: Strong Password Policies: Key Concepts
| Concept | Description |
|---------|-------------|
Output Format
Ad Asreproast Attack — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]
Findings Summary:
[Finding 1]: [Severity] — [Brief description]
[Finding 2]: [Severity] — [Brief description]
Detailed Results:
Phase 1: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Phase 2: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
1. [Immediate remediation step]
2. [Long-term hardening measure]
3. [Monitoring/detection improvement]
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
References
