GetNPUsers.py
AS-REP Roasting: tickets of accounts without pre-auth (impacket).
GetNPUsers.py (Impacket) performs AS-REP Roasting: it requests the AS-REP of accounts with Kerberos pre-authentication disabled and returns an offline-crackable hash. It needs no credentials, just a list of valid users.
Family Kerberos & tickets
Flags -no-pass -request -usersfile
Concepts AS-REP Roasting, Hash Cracking
Cheatsheet Kerberos
Installation
# All of Impacket's *.py tools ship in the same package:
pipx install impacket
# invoke them as impacket-<tool> or <Tool>.py depending on the packagingUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- ActiveHackTheBox
- AdministratorHackTheBox
- CertifiedHackTheBox
- ForestHackTheBox
- SaunaHackTheBox