AS-REP Roasting

How the Attack Works

This attack targets the AS-REQ/AS-REP portion of the Kerberos authentication process. Based on the AS-REQ request, the domain controller can validate if the authentication is successful. If it is, the domain controller replies with an AS-REP containing the session key and TGT. This process is also referred to as Kerberos Preauthentication and prevents offline password guessing.

Without Kerberos preauthentication in place, an attacker could send an AS-REQ to the domain controller on behalf of any AD user. After obtaining the AS-REP from the domain controller, the attacker could perform an offline password attack against the encrypted part of the response. This attack is called AS-REP Roasting

Identify Vulnerable Users with PowerView.ps1

To identify users with the enabled AD user account option Do not require Kerberos preauthentication, PowerView's Get-DomainUser function can be used with the option PreauthNotRequired on Windows.

On Unix, we can use the impacket-GetNPUsers.

If you have GenericWrite or GenericAll permissions on an AD user account, you could use themese permissions to modify the User Account Control value of the users to not require Kerberos preauthentication. This attack is known as Targeted AS-REP Roasting. Once obtaining the hash, we should reset the User Account Control value of the user.

Performing the Attack

impacket-GetNPUsers

Can check for accounts vulnerable to AS-REP roasting by using impacket-GetNPUsers

root@kali# cat users
Administrator
andy
lucinda
mark
santi
sebastien
svc-alfresco

Check for users vulnerable

The resulting hash format of impacket-GetNPUsers is compatible with Hashcat.

AS-REP with Rubeus

Rubeus is a toolset for raw Kerberos interactions and abuses. If we are a pre-authenticated domain user, you do not need to provide any other options to Rubeus except asreproast and Rubeus will automatically identify vulnerable user accounts. We can also add the flag /nowrap to prevent new lines being added to the resulting AS-REP hashes.

You can then bruteforce the hash on your local attack machine

Last updated