Kerberoasting via AS-rep
Kerberoasting via AS-REP Roasting
Normally, to request a TGS ticket for Kerberoasting, you first need a TGT. To get a TGT, you usually need the password of at least one valid user in the domain.
But what if you are on a network and don't have any valid passwords yet?
You can chain two Active Directory attacks together: AS-REP Roasting and Kerberoasting. Sometimes, sysadmins configure certain accounts with the setting "Do not require Kerberos preauthentication" - this means we can interact with the KDC on behalf of the user (without knowing their password!)
We can use an AS-REP roastable account to act as our initial foothold to Kerberoast other targets.
Identifying Valid Users
But here's the problem... if we are starting with no credentials, how do we get a list of domain users?
Well, we have to rely on misconfigurations. We can test the Domain Controller to see if it will talk to us without forcing us to authenticate.
Explaining why this works is out-of-scope for this Guided Lab, but we'll make another one soon on initial access.
## Connecting with a Null Session
nxc smb [DC-IP] -u '' -p '' --users-export usernames.txt
## Connecting with the Guest account
nxc smb [DC-IP] -u 'guest' -p '' --users-export users.txt
If any of these methods succeed, you now have a full list of usernames. Save those to a text file (i.e. usernames.txt or users.txt). They should have ONLY the usernames.
3. Identify Users Vulnerable to AS-REP Roasting
Before we can Kerberoast, we need to find at least one user in the domain vulnerable to AS-REP Roasting. We can use Netexec again for this:
If there is a user vulnerable to AS-REP Roasting, you will find them in output.txt after running this attack.
4. Kerberoasting via AS-REP Roasting
Finally, we are ready to performing a Kerberoasting attack with the AS-REP Roastable user we identified
You can use the same steps as before to crack the hash in kerberoast_hashes.txt to retrieve the plaintext password of the victim user.
Targeted (Blind) Kerberoasting - Example Impacket
Normally, Kerberoasting requires a valid domain credential to request Service Tickets (TGS) for accounts with SPNs. However, since we obtained an AS-REP hash for tspivey (even though uncracked), we can use that account's context to perform a "blind" Kerberoast attack against the domain.
(Alternatively, using NetExec syntax as shown in the video):
Result: Successfully obtained a Kerberos Ticket Granting Service (TGS) hash for the user j.reed.
Last updated