AS-REP Roasting is one of the easiest ways to obtain Active Directory credentials without knowing a password. If a user has Kerberos Preauthentication disabled, the Domain Controller returns an AS-REP response that can be cracked offline.

In this lab, I’ll show how I found a vulnerable account, cracked its password, and authenticated to the domain.

Lab

• Domain: lab.local
• DC: 192.168.56.104
• Attacker: Kali Linux

Step 1 — Guess Usernames

The first step is getting valid usernames.

In a real environment, these could come from LinkedIn, company emails, or OSINT. For this lab, I created a simple users.txt file.

Step 2 — Find Vulnerable Accounts

I used GetNPUsers.py to check whether any user has Kerberos preauthentication disabled.

GetNPUsers.py lab.local/ -usersfile users.txt -dc-ip 192.168.56.104 -no-pass

If an account is vulnerable, Impacket returns an AS-REP hash.

In my lab, the account svc_sql was vulnerable.

Step 3 — Crack the Hash

Next, I saved the hash into hash.txt and cracked it with Hashcat.

hashcat -m 18200 hash.txt /home/<user>/Desktop/GOAD-LAB/GOAD/common-password-list/rockyou.txt

Hashcat recovered the password:

svc_sql : password@123

Since this is an offline attack, the Domain Controller never sees the password guesses.

Step 4 — Verify the Credentials

Finally, I verified the recovered password using NetExec.

netexec smb 192.168.56.104 -u svc_sql -p 'password@123'

Authentication was successful, confirming the credentials were valid.

Why Does This Work?

The account had “Do not require Kerberos Preauthentication” enabled.

Because of this, the Domain Controller returned an encrypted AS-REP response without asking for a password, allowing it to be cracked offline.

If we disable “Do not require Kerberos Preauthentication” will get output like this:

How to Prevent AS-REP Roasting

1. Enable Kerberos Preauthentication

2.Use strong passwords for service accounts

3. Use Group Managed Service Accounts (gMSA)

4. Regularly audit accounts with preauthentication disabled

5. Monitor Kerberos authentication events

Disclaimer: This article is written entirely for educational purposes and to help Active Directory administrators better defend their environments against advanced Kerberos attacks. The AES-Roasting attack showcased here was conducted in a controlled, self-hosted lab environment. Unsanctioned exploitation of these techniques on live, production systems without explicit authorization is strictly against the law. The author is not responsible for any malicious use of this material.

— Written by

Aruvasaga Chithan A

Ethical Hacker & Cyber Security Researcher.

Thanks for reading — your support keeps me writing.
See you in the next article…

Linkedin.