🧠Active Directory - AS-REP Roasting
What is it?
- Concept: Kerberos pre-authentication normally requires a client to prove it knows the account’s password before the KDC issues anything back. If pre-auth is disabled on an account, anyone can request an AS-REP for that username with zero credentials at all — and part of that reply is encrypted with the account’s own password hash.
- Impact: Recovery of a plaintext password for any account with pre-auth disabled, requiring no valid credentials whatsoever — unlike Active Directory - Kerberoasting, which at least needs one authenticated account to kick off.
How it works
Kerberos pre-authentication exists specifically to stop this: normally the client has to encrypt a timestamp with its own password hash and send it along with the initial AS-REQ, proving password knowledge before the KDC replies with anything sensitive. When pre-auth is turned off for an account (Do not require Kerberos preauthentication, sometimes set for legacy application compatibility), the KDC skips that check and hands back an AS-REP to anyone who asks for that username — no password needed to trigger it. The returned reply still contains a portion encrypted with the target account’s password hash, so it’s crackable offline exactly like a Kerberoast hash.
Exploitation
Prerequisites
- A list of candidate usernames (no credentials needed at all)
Attack Vectors
impacket-GetNPUsers <domain>/ -usersfile usernames.txt -no-pass -dc-ip <dc_ip>hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txtNotes
- Since no credential is required, this is worth trying against every enumerated username immediately, before any other authentication is attempted.
- A cracked AS-REP password often turns out to be reused elsewhere (autologon registry entries, scheduled tasks, other service accounts) — treat it as a pivot point, not just a login.
Mitigation
- Fix: Only disable Kerberos pre-authentication when there’s no alternative, and use long/random passwords on any account that has it disabled so the offline hash can’t realistically be cracked.
Related Usage
| File | Created |
|---|---|
| HTB - Sauna | Tuesday, July 21st 2026, 4:41:17 am |
References: