6.3.3 Check for accounts whose AS-REP responses support offline password recovery AS-REP roasting — conditions and output
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A known username/realm and KDC connectivity. A password is not required for the no-preauthentication branch; authenticated discovery is an alternative.
Where to look: Inspect the account's preauthentication configuration or perform the selected-account request. Keep username existence, preauthentication setting, returned cipher and recovered password as separate evidence states.
Expected behavior / secure boundary: Kerberos preauthentication is normally required. An account configured without it may expose an offline-guessable response. Strong credentials can still make guessing infeasible; receiving a response is not account compromise.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.3.1 Check a known user for AS-REP recovery from your shell One known user, no password — Shell
Run: Kali / Linux with Impacket. Requires: Known target username/realm and KDC route; no password for the selected no-preauth request. Effect: Requests AS-REP material; does not recover a password by itself.
impacket-GetNPUsers 'DOMAIN/TARGET_USER' -no-pass -request \
-dc-ip DC_IP -outputfile asrep-TARGET_USER.hashes
6.3.3.2 Query AS-REP candidates with your accepted shell identity Authenticated directory-backed discovery — Shell
Run: Kali / Linux with Impacket. Requires: Valid querying identity and directory/KDC route. Effect: Authenticated discovery/ticket requests; no directory modification.
impacket-GetNPUsers 'DOMAIN/USER' -request \
-dc-ip DC_IP -outputfile asrep.hashes
What this checks: GetNPUsers requests AS-REP material for a compatible account. The no-pass form does not submit password guesses. The authenticated form can discover/request eligible material with the supplied identity.
6.3.3.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
$krb5asrep$23$svc_legacy@example.test:SYNTHETIC_NOT_A_HASH
Alternative: User svc_modern does not have UF_DONT_REQUIRE_PREAUTH set
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| $krb5asrep$23$ | Typed RC4 AS-REP verifier, if actual complete output. | Use the matching offline format; the displayed example is deliberately invalid. | §6.3.2.1 — Classify recovered credentials and their scope |
| Preauthentication required | This account is not eligible for this method now. | Move to another supported clue; do not call the password invalid. | §6.2.4.1 — Enumerate service accounts and SPNs |
| KDC timeout | The request did not produce account evidence. | Check DC address, realm and KDC connectivity. | §6.5.1.1 — Diagnose the failed boundary |
Stop when: Eligibility, returned artifact type or the precise failed boundary is known.
Revisit only when: Account preauthentication, username/realm or KDC connectivity changes.
6.3.3.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | A complete compatible verifier is returned: assess offline guessing feasibility. | §6.3.2.1 — Classify recovered credentials and their scope |
| Ruled out in this context | Preauthentication is required for that account: rule out this branch. | §6.2.4.1 — Enumerate service accounts and SPNs |
| Inconclusive / failed check | Timeout or unknown principal: separate transport from spelling/realm and account existence. | §6.5.1.1 — Diagnose the failed boundary |
6.3.3.5 Tooling and complete procedure
Kali impacket-GetNPUsers is the baseline; Rubeus is a Windows alternative. Names may use upstream .py entry points instead of Kali wrapper names. Hashcat/John applies only after format classification. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.