AS-REP Roasting

AS-REP Roasting abuses Active Directory accounts that have Kerberos pre-authentication disabled to crack their password offline.

Normally, before handing over the AS-REP, the KDC requires pre-authentication: the client encrypts a timestamp with its password hash and the KDC verifies it. If an account has the DONT_REQ_PREAUTH flag (bit 0x400000 of userAccountControl), that step is skipped: anyone can request an AS-REP for that user without knowing their password, and part of the response is encrypted with the account's NT hash. That block is extracted and cracked offline.

Unlike Kerberoasting, not even a prior credential is needed: knowing the name of a vulnerable user is enough, so it is usually combined with user enumeration (web, LDAP, kerbrute).

Mechanism

With a user list and no credentials, GetNPUsers requests each user's AS-REP and returns the hash only for those that do not pre-authenticate:

impacket-GetNPUsers <domain>/ -no-pass -usersfile users.txt -format hashcat -outputfile asrep.hash

With valid credentials already, you ask LDAP who has the flag set and request all their AS-REPs at once:

impacket-GetNPUsers -dc-ip <dc> <domain>/<user>:<pass> -request -format hashcat

kerbrute combines enumeration and roast: while validating users, it automatically retrieves the AS-REP of anyone without pre-authentication. From Windows, PowerView locates the accounts and Rubeus does the roast:

Get-DomainUser -PreauthNotRequired | select samaccountname,useraccountcontrol
.\Rubeus.exe asreproast /user:mmorgan /nowrap /format:hashcat

The resulting block carries the prefix $krb5asrep$23$user@DOMAIN:... and is cracked with hashcat in mode 18200:

hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

Verification. The cracked hash is only a candidate password: validate it with netexec over SMB/WinRM ((Pwn3d!)) to confirm the account exists, is enabled, and works on some service.

Requirements

Reachability to the KDC (88/tcp) and a user list; without credentials it still works as long as at least one account carries DONT_REQ_PREAUTH. Final success depends entirely on that account's password being weak.

Nuance. Like Kerberoasting, AS-REP Roasting does not guarantee access: it is a door to an offline crack that only opens if the password is weak. The block is encrypted in RC4 (mode 18200), fast to crack; if the account forces AES the crack becomes much slower. And it depends entirely on finding an account with DONT_REQ_PREAUTH, which does not always exist.

How to detect it. Requesting the AS-REP generates an Event ID 4768 (a Kerberos authentication ticket was requested) on the DC with the Pre-Authentication Type field set to 0 (no pre-auth): a value that in practice only appears when someone is roasting, because normal accounts do pre-authenticate. The footprint is reinforced if the requested encryption is RC4 (0x17) and if several 4768 with preauth 0 arrive for different users from one IP in a short time (a sweep with a user list). A decoy account with DONT_REQ_PREAUTH and no use turns any 4768 against it into a direct alarm.

Defence. Do not disable pre-authentication unless truly needed, and set long, random passwords (or gMSAs) on any account that has it disabled, so the stolen block cannot be cracked. Periodically auditing the DONT_REQ_PREAUTH flag closes the window. The recovered password is then exploited with credential reuse or feeds password-spraying.