Exploiting Username - ASREPRoast

The ASREPRoast attack looks for users without Kerberos pre-authentication required attribute (DONT_REQ_PREAUTH).

That means that anyone can send an AS_REQ request to the DC on behalf of any of those users, and receive an AS_REP message. This last kind of message contains a chunk of data encrypted with the original user key, derived from its password. Then, by using this message, the user password could be cracked offline.

Furthermore, no domain account is needed to perform this attack, only connection to the DC. However, with a domain account, a LDAP query can be used to retrieve users without Kerberos pre-authentication in the domain. Otherwise usernames have to be guessed.

ASREP - roasting

We create a users.txt file with all the user name previously found on north.sevenkingdoms.local

cat users.txt

Administrator
vagrant
krbtgt
newyork$
pablo.Sandoval
fernando.Alonzo
valentino.alcantara
matias.Almonte
alejandro.Rodriguez
claudio.Ortiz
salvador.Aguilar
pacofish
elena.Lopez
miguel.Cabrera
joel.exposito
sql_svc

We now could try asreproasting on all the users with impacket:

  • We get a ticket for claudio.ortiz and we will try to break it the user don’t require kerberos pre-authentication.

  • This needs to be done on your local machine

We now have two couple of credentials

Previoussetup /etc/hosts and kerberosNextPassword Spraying

Last updated