← Back to Academy

Academy Node

DONT_REQ_PREAUTH Found

This flag means a user does not require Kerberos pre-authentication and may be ASREP roastable.

Beginner100 XPFinding

Why it matters

It gives an offline crack path without needing that user's password.

How to identify it

  • LDAP UAC flag
  • BloodHound ASREP roastable
  • GetNPUsers returns hash

BloodHound indicators

  • DoesNotRequirePreAuth=true

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u users.txt -p '' --asreproast asrep.txt

Impacket commands

impacket-GetNPUsers xutslabs.local/ -usersfile users.txt -dc-ip 192.168.184.141 -no-pass -outputfile asrep.txt

Expected output

  • $krb5asrep$23$

Success looks like

  • ASREP hash obtained

Failure looks like

  • No hash
  • User does not exist
  • Preauth required

Troubleshooting

  • Try exact sAMAccountName
  • Sync time

Common mistakes

  • Not cracking with mode 18200
  • Bad user list

Alternative attacks

  • Kerberoast

What to try next

  • ASREP Roast
  • Crack hash
  • Validate creds

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.