Kerberoasting & AS-REP roasting

When it applies

You have valid domain credentials (kerberoasting) or just a username list (AS-REP). Both recover plaintext passwords offline by cracking Kerberos-issued material — no lockout risk.

Why it works

• Kerberoasting: any authenticated user can request a service ticket (TGS) for any account with an SPN; part of it is encrypted with the service account's password hash. Crack it offline.
• AS-REP roasting: accounts with "do not require Kerberos preauth" hand out an AS-REP encrypted with the user's key to anyone — no creds needed, just the username.

Method

1. Kerberoast (need creds): impacket-GetUserSPNs corp.local/user:pass -dc-ip DC -request (or nxc ldap DC -u user -p pass --kerberoasting out.txt). Service accounts are prime targets.
2. AS-REP roast (no creds needed): impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -request — pulls hashes for pre-auth-disabled accounts.
3. Crack offline: hashcat -m 13100 (TGS) / -m 18200 (AS-REP) with rockyou + rules.
4. Use the creds: service accounts are often privileged → lateral movement / DA path (ad-pivot-arsenal, network-pivoting-tunneling).

Gotchas

• Offline cracking = no account lockout, but a weak-password dependency; strong passwords resist.
• Target high-value SPNs (SQL, web, admin service accounts) first.
• Clock skew breaks Kerberos — sync time to the DC (ntpdate/faketime) if you get KRB_AP_ERR_SKEW.

Verify success

A cracked plaintext password for a domain account, then authenticated access with it.

References

impacket GetUserSPNs/GetNPUsers; hashcat modes 13100/18200; "Kerberoasting" (Harmj0y).