AS-REP Roasting
Let’s perform this attack from our Kali machine first,
then on Windows.
On Kali,
we can use impacket-GetNPUsers to perform AS-REP roasting.
We’ll need to enter the IP address of the domain controller
as an argument for -dc-ip,
the name of the output file in which the AS-REP hash will be stored
in Hashcat format for -outputfile,
and -request to request the TGT.
Finally, we need to specify the target authentication information
in the format domain/user.
This is the user we use for authentication.
For this example, we’ll use pete with the password from the previous section.
The output shows that dave has the user account option
Do not require Kerberos preauthentication enabled,
meaning it’s vulnerable to AS-REP Roasting.
By default, the resulting hash format
of impacket-GetNPUsers is compatible with Hashcat.
Therefore, let’s check the correct mode for the AS-REP hash
by grepping for “Kerberos” in the Hashcat help.
The output of the grep command shows that the correct mode for AS-REP
is 18200.
We’ve now collected everything we need to launch Hashcat
and crack the AS-REP hash.
Let’s enter the mode 18200,
the file containing the AS-REP hash,
rockyou.txt as wordlist,
best64.rule as rule file,
and --force to perform the cracking on our Kali VM.
Very nice!
Hashcat successfully cracked the AS-REP hash.
The output shows that the user dave has the password Flowers1.
As mentioned, we can also perform AS-REP Roasting on Windows.
To perform this attack,
we’ve connected to CLIENT75 via RDP as domain user jeff with his credentials.
We’ll use Rubeus, which is a toolset for raw Kerberos interactions and abuses.
Since we’re performing this attack as a pre-authenticated domain user,
we don’t have to provide any other options to Rubeus except asreproast.
Rubeus will automatically identify vulnerable user accounts.
The output shows that Rubeus identified dave as vulnerable to AS-REP Roasting
and displays the AS-REP hash.
Next, let’s copy the AS-REP hash.
We pasted it into a text file named hashes.asreproast2
in the home directory of user kali.
We removed all line breaks and spaces so that the AS-REP hash is on one line.
Additionally we added the compatible separator $23.
We can now start Hashcat again to crack the AS-REP hash.
Nice!
Hashcat successfully cracked the AS-REP hash.
In this section, we first explored the theory behind AS-REP Roasting.
We then performed this attack on Kali
with impacket-GetNPUsers and on Windows with Rubeus.
In the next section, we’ll perform a similar attack,
but instead of abusing a missing Kerberos preauthentication, we’ll target SPNs.