AS-REP Roasting
How the Attack Works
This attack targets the AS-REQ/AS-REP portion of the Kerberos authentication process. Based on the AS-REQ request, the domain controller can validate if the authentication is successful. If it is, the domain controller replies with an AS-REP containing the session key and TGT. This process is also referred to as Kerberos Preauthentication and prevents offline password guessing.
Without Kerberos preauthentication in place, an attacker could send an AS-REQ to the domain controller on behalf of any AD user. After obtaining the AS-REP from the domain controller, the attacker could perform an offline password attack against the encrypted part of the response. This attack is called AS-REP Roasting
Identify Vulnerable Users with PowerView.ps1
To identify users with the enabled AD user account option Do not require Kerberos preauthentication, PowerView's Get-DomainUser function can be used with the option PreauthNotRequired on Windows.
On Unix, we can use the impacket-GetNPUsers.
If you have GenericWrite or GenericAll permissions on an AD user account, you could use themese permissions to modify the User Account Control value of the users to not require Kerberos preauthentication. This attack is known as Targeted AS-REP Roasting. Once obtaining the hash, we should reset the User Account Control value of the user.
Performing the Attack
impacket-GetNPUsers
Can check for accounts vulnerable to AS-REP roasting by using impacket-GetNPUsers
root@kali# cat users
Administrator
andy
lucinda
mark
santi
sebastien
svc-alfrescoCheck for users vulnerable
The resulting hash format of impacket-GetNPUsers is compatible with Hashcat.
AS-REP with Rubeus
Rubeus is a toolset for raw Kerberos interactions and abuses. If we are a pre-authenticated domain user, you do not need to provide any other options to Rubeus except asreproast and Rubeus will automatically identify vulnerable user accounts. We can also add the flag /nowrap to prevent new lines being added to the resulting AS-REP hashes.
You can then bruteforce the hash on your local attack machine
Last updated