> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/active-directory/_vulnerabilities/as-rep-roasting.md).

# AS-REP roasting

### AS-REP roasting

AS-REP roasting targets Active Directory accounts that have Kerberos pre-authentication disabled ("Do not require Kerberos preauthentication"). Normally a client must prove knowledge of its password before the KDC responds, but for these accounts an attacker can request an authentication ticket (AS-REP) for the user without any credentials, and the KDC returns a response containing data encrypted with the user's password-derived key. The attacker (typically using Impacket's GetNPUsers or Rubeus) extracts this encrypted blob and cracks it offline with Hashcat to recover the account's plaintext password. The risk is credential theft leading to lateral movement and privilege escalation, especially dangerous if a roastable account is privileged or reuses a weak password, and the root cause is that disabling Kerberos pre-authentication (often set for legacy compatibility) lets anyone request encrypted material tied to a user's password, turning a weak password into an offline-crackable hash without needing any prior access.

<figure><img src="https://3765741850-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBecGguRFXU4mnIRly0ZA%2Fuploads%2F3KHSgO6WA5JVAta3ynIm%2Fafbeelding.png?alt=media&amp;token=c2538447-5b64-49a3-8951-1122d6140ccb" alt=""><figcaption></figcaption></figure>

### Exploitation

```bash
# 1. Retrieve all - AS-REP roastable accounts from the domain in hashcat format (domain users samaccount names in users.txt)
GetNPUsers.py '{{DOMAIN}}'.'{{ROOTDNS}}'/ -usersfile users.txt -format hashcat -outputfile hashes.asreproast
 
# 2. Utilizing nxc
nxc ldap {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' --asreproast asreproast.txt
```