AS-REP Roasting – Pre-Auth Disabled Hash Cracking

When a domain account has pre-authentication disabled (DONT_REQ_PREAUTH), the KDC will respond to an AS-REQ with an AS-REP containing a portion of the response encrypted with the user's password hash — without verifying who is asking. That encrypted blob can be cracked offline.

Unlike Kerberoasting, this does not require valid domain credentials. As long as you have a username list and network access to port 88 on the DC, you can extract hashes for all vulnerable accounts.

If you have valid credentials and want to check for AS-REP roastable accounts, see the enumeration note below. For roasting SPNs once you have creds, see Kerberoasting at https://hackindex.io/services/kerberos/exploitation/kerberoasting.

Roasting Without Credentials

impacket-GetNPUsers sends AS-REQ requests without pre-authentication for a list of usernames. Valid usernames that have pre-auth disabled return a crackable hash. Invalid usernames return KDC_ERR_C_PRINCIPAL_UNKNOWN.

Against a list of usernames:

Against a single username:

$23 is RC4. If you see $17 or $18, the account is configured for AES-only — cracking is slower.

Roasting With Valid Credentials

If you have domain credentials, you can enumerate which accounts are vulnerable through LDAP and roast them in the same step:

With no -usersfile, Impacket queries LDAP for all accounts with DONT_REQ_PREAUTH set and roasts them automatically.

With nxc:

Roasting from Windows with Rubeus

Target a specific user:

Cracking with Hashcat

AS-REP hashes use mode 18200:

With rules:

With John:

Clock Skew Errors

If you see KRB_AP_ERR_SKEW (Clock skew too great), your attack box clock is too far out of sync with the DC. Kerberos requires clocks to be within 5 minutes. Sync to the DC:

Or force-set the time if ntpdate fails:

What to Do with a Cracked Hash

The cracked password is valid domain credentials for the account. Use it to authenticate to services, enumerate AD further, or pivot depending on what privileges the account holds. Feed it into BloodHound to map any privilege paths from that identity.

If the account has an SPN assigned, also try Kerberoasting it at https://hackindex.io/services/kerberos/exploitation/kerberoasting to potentially escalate further.