🎫AS-REP Roasting

AS-REP Roasting is a credential access attack against Microsoft Active Directory that targets a specific Kerberos misconfiguration where Kerberos pre-authentication is disabled for user accounts. When pre-authentication is disabled, the Domain Controller (DC) will return a Kerberos Authentication Service Response (AS-REP) containing encrypted data without first validating the password. Attackers can extract this encrypted part and crack it offline to recover the user’s plaintext password.

Why It Works:

In normal Kerberos authentication:

1. A client sends an Authentication Service Request (AS-REQ) to the KDC.

2. The AS-REQ must include a timestamp encrypted with the user’s password hash — this is pre-authentication.

3. The KDC decrypts the timestamp to verify the user knows the password.

4. If successful, the KDC returns an AS-REP containing the Ticket Granting Ticket (TGT) encrypted with the user’s secret

When pre-authentication is disabled for an account:

• The KDC does not require the encrypted timestamp.

• It immediately returns an AS-REP with encrypted data — including something protected by the user’s password hash.

• Since attackers don’t have the password yet, they capture this encrypted portion — essentially a hash — and then crack it offline using brute-force or dictionary attacks.

Without pre-authentication disabled, the attack does not work. Kerberos pre-authentication is enabled by default — meaning this is a rare misconfiguration but still present in many environments for legacy support or certain service accounts.

AS-REP Roasting vs Kerberoasting:

Feature	AS-REP Roasting	Kerberoasting
Target	User accounts with pre-auth disabled	Accounts with SPNs
Ticket	AS-REP (TGT type)	TGS (service ticket)
Depends on	Pre-auth misconfiguration	SPN presence
Requires	No initial creds	Usually a domain user context
Cracking	Offline cracking of AS-REP hash	Offline cracking of TGS hash

Example Attack:

We gonna use tool from Impacket collection:

┌──(hacker@attack-machine)-[~]
└─$ impacket-GetNPUsers domain.local/ -no-pass -usersfile users.txt -dc-ip 10.10.10.10
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[email protected]:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac 

After obtaining a hash, we can crack it with Hashcat:

hashcat -m 18200 hash.txt ~/wordlists/rockyou.txt

You can use cheatsheet if you forgot the commands.

References & More About AS-REP Roasting:

Steal or Forge Kerberos Tickets: AS-REP Roasting, Sub-technique T1558.004 - Enterprise | MITRE ATT&CK®attack.mitre.org

Roasting AS-REPsMedium

---

Alike:

Kerberoasting