XUTS LABS
Back to Red Team Playbooks
Active DirectoryRed Team Playbook

AS-REP Roasting

Identify accounts with Kerberos pre-authentication disabled and request AS-REP material for approved offline audit.

KerberosAS-REPImpacket

Purpose

Separate AS-REP roasting from Kerberoasting and preserve correct Impacket syntax.

Inputs

  • - DOMAIN
  • - DC_IP
  • - users.txt
  • - output hash file

Prerequisites

  • - DOMAIN
  • - DC_IP
  • - User list
  • - Authorization for credential-audit testing

Operator Assumptions

  • - No password is needed for user-list checks when pre-auth is disabled.
  • - A valid domain name is still required.

Commands

User-list AS-REP check

Kali
GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC_IP -no-pass -format hashcat -outputfile asrep.hashes

Why: Request AS-REP material for users that do not require pre-auth.

Expected: Hashcat-format AS-REP hashes or a no-vulnerable-users result.

Authenticated AS-REP check

Kali
GetNPUsers.py DOMAIN/user:'Password' -dc-ip DC_IP -request -format hashcat -outputfile asrep.hashes

Why: Enumerate roastable users using a known account.

Expected: Roastable account list and hashes.

Decision Points

  • - If no users are roastable, move to SPN checks.
  • - If domain is unknown, perform RootDSE first.
  • - If account lockout is unknown, avoid password guessing.

Follow-On Actions

  • - Kerberoasting
  • - LDAP Enumeration
  • - Password policy review

Evidence To Capture

  • - Command line
  • - User list provenance
  • - Hash output location
  • - Negative results

Common Failures

  • - Confusing GetNPUsers.py with GetUserSPNs.py
  • - Missing DOMAIN
  • - Clock skew

Operational Cautions

  • - Protect hash files as credential material.
  • - Do not invent users or domains.

Related Content

AS-REP RoastingAsk EXO