AS-REP Roast
Theory
AS-REP roasting is an attack that is often-overlooked in my opinion it is not extremely common as you have to explicitly set Accounts Does not Require Pre-Authentication aka DONT_REQ_PREAUTH
Pre-Authentication is the first step in Kerberos Authentication and it’s main role is to try prevent against brute-force password guessing attacks.
Typcially during Pre-Auth a user will enter his creds which will be used to encrypt a time stamp and the DC will decrypt it to validate that the correct creds were used. If the DC verifies okay it will issue a TGT however if Pre-Authentication is disabled it would allow an attacker to request a ticket for any user and the DC would simply return a TGT which will be encrypted similar to the Kerberoast attack which can be cracked offline.
AS-REP is cool as you don’t even have to do it from a Domain-Joined Machine or Domain-User you just have to have access to request to the KDC however being on a Domain-Joined Machine or having Domain Creds will make the enumeration process way easier as you can simply use LDAP Filter or PowerView to find targets.
Such as:
Request AS_REP Message
If you have a credential:
If you don't have a credential:
Note that the / in <domain_name>/ is required, otherwise GetNPUsers won't recongize that string as a domain
TGT Cracking
Crack the TGT ticket with John:
Or with hashcat:
Reference
Last updated