What is AS-REP Roasting Exploitation: A Comprehensive Guide

Introduction

AS-REP Roasting is a critical attack technique that exploits a fundamental misconfiguration in Kerberos authentication, particularly within Active Directory environments. This sophisticated attack specifically targets user accounts where Kerberos pre-authentication has been disabled, allowing attackers to extract and crack user password hashes offline without triggering account lockouts or generating significant security alerts. In modern enterprise networks, Active Directory serves as the cornerstone of identity and access management, with Kerberos functioning as the default authentication protocol for Windows environments since Windows 2000.The security of these environments heavily depends on the proper configuration of Kerberos pre-authentication, a security feature designed to prevent unauthorized users from obtaining encrypted credential material without first proving their identity. The pre-authentication mechanism requires users to encrypt a timestamp with their password hash before the Key Distribution Center (KDC) will process authentication requests. When this critical security control is disabled—often for legacy application compatibility or due to administrative oversight—it creates a significant vulnerability that attackers can exploit with minimal technical sophistication. This simple yet effective control prevents attackers from blindly requesting Ticket Granting Tickets (TGTs) and obtaining encrypted material suitable for offline password cracking.

The consequences of successful AS-REP Roasting attacks extend far beyond simple credential compromise. Once attackers crack these passwords offline using GPU-accelerated tools, they gain legitimate access to Active Directory resources, enabling lateral movement, privilege escalation, and potentially complete domain compromise. The attack’s stealthy nature makes it particularly dangerous: the offline cracking phase generates no network traffic, avoids account lockout mechanisms, and leaves minimal forensic evidence on domain controllers. Understanding both the technical mechanics of AS-REP Roasting and implementing comprehensive preventive security practices is essential for modern cybersecurity professionals, penetration testers, security operations center (SOC) analysts, and system administrators responsible for protecting Active Directory infrastructure.

Learning Objectives

By reading this article, you will:

• Understand the fundamentals of Kerberos protocol and the pre-authentication mechanism
• Learn how AS-REP Roasting attacks operate and the risks they pose
• Become familiar with popular tools and techniques used to execute this attack
• Understand detection and mitigation strategies
• Grasp the key differences between AS-REP Roasting and Kerberoasting

What Is AS-REP Roasting Attack?

AS-REP Roasting is a credential access technique that targets user accounts in Active Directory where the “Do not require Kerberos pre-authentication” attribute is enabled. This attack exploits a critical security weakness in the Kerberos authentication protocol’s initial authentication exchange. In a properly configured Kerberos environment with pre-authentication enabled, users must first prove their identity by encrypting a timestamp with their password-derived key before the Key Distribution Center (KDC) issues a Ticket Granting Ticket (TGT). This mechanism serves as a critical defense against offline password attacks by ensuring that only users who know the correct password can initiate the authentication process.However, when the pre-authentication requirement is disabled—typically to support legacy applications or systems that don’t support modern Kerberos features—attackers can send an AS-REQ (Authentication Server Request) message for any targeted user account without providing any credentials whatsoever. The Domain Controller, following the account’s configuration, responds with an AS-REP (Authentication Server Response) message containing encrypted data. This response includes a session key and other authentication material encrypted with a key derived from the user’s password hash, typically using RC4-HMAC encryption (encryption type 0x17). The attacker can capture this AS-REP response and extract the encrypted portion, which now contains everything needed for an offline brute-force attack. Unlike online password attacks that generate failed authentication logs and can trigger account lockouts, this offline approach allows unlimited password attempts without any risk of detection or account disruption.

Once the AS-REP hash is extracted, attackers leverage GPU-accelerated password cracking tools such as Hashcat or John the Ripper to perform dictionary attacks, rule-based attacks, or brute-force attacks against the captured hash. If the account uses a weak or commonly used password, recovery can occur within seconds to minutes. Even moderately complex passwords may fall within hours or days when subjected to modern cracking rigs equipped with high-performance graphics cards. The cracked password grants the attacker legitimate credentials for the compromised account, enabling them to authenticate to domain resources, move laterally across the network, escalate privileges, and potentially establish persistent access to the environment.

This technique exhibits several characteristics that make it particularly attractive to attackers and challenging to defend against:

• Targets high-value accounts: AS-REP Roasting typically affects service accounts, machine accounts, and legacy application accounts that often possess elevated privileges or access to sensitive systems and data.
• Password complexity determines success rate: The time required for successful password recovery is directly proportional to password strength. Accounts with weak passwords (8-12 characters, dictionary words, or common patterns) can be compromised almost instantly, while stronger passwords (15+ characters with high entropy) may resist cracking for extended periods.
• Extremely difficult to detect during exploitation: The offline nature of the password cracking phase makes this attack nearly invisible to security monitoring solutions. While the initial AS-REQ requests generate Event ID 4768 logs, these appear as normal authentication attempts. The actual password cracking occurs on attacker-controlled infrastructure, completely outside the visibility of domain controllers, SIEM platforms, and network monitoring tools.

How AS-REP Roasting Works

AS-REP Roasting follows a systematic, multi-phase attack methodology that exploits the absence of Kerberos pre-authentication. Understanding each stage of this attack chain is crucial for both offensive security practitioners conducting authorized penetration tests and defensive teams implementing detection and mitigation strategies. The attack progresses through five distinct phases, each building upon the previous step to ultimately compromise user credentials and establish unauthorized access to Active Directory resources. The sophistication of AS-REP Roasting lies not in technical complexity, but in its ability to exploit a simple misconfiguration while remaining largely invisible to traditional security monitoring systems. Unlike attacks that generate obvious indicators of compromise, AS-REP Roasting disguises malicious activity within the normal flow of Kerberos authentication traffic. This stealth characteristic, combined with the offline nature of password cracking, makes it one of the most effective credential access techniques in the modern threat landscape.

The entire attack can be executed with minimal privileges—in many cases requiring no authentication whatsoever—making it accessible to attackers at the initial reconnaissance stage of an intrusion. Once successful, the compromised credentials provide legitimate access to the domain, allowing attackers to blend seamlessly with normal user activity while conducting further reconnaissance, lateral movement, and privilege escalation operations. Let’s examine each phase of the AS-REP Roasting attack lifecycle in detail:

Phase 1: Discovery and Account Identification:

The attack begins with reconnaissance to identify Active Directory accounts with Kerberos pre-authentication disabled. Attackers use PowerShell commands with Active Directory modules, the PowerView framework’s Get-DomainUser -PreauthNotRequired command, or LDAP queries from Linux environments to filter for accounts where the userAccountControl attribute includes the DONT_REQ_PREAUTH flag. In many environments, these LDAP queries can be performed anonymously without authentication, allowing external attackers to identify vulnerable accounts during the initial reconnaissance phase.

Phase 2: Sending AS-REQ Messages:

Once vulnerable accounts are identified, the attacker sends Authentication Server Request (AS-REQ) messages to the domain controller for each target account. Because pre-authentication is disabled, these requests contain no credentials or proof of identity—just a request for a Ticket Granting Ticket (TGT) for the specified username. Tools like Rubeus on Windows and GetNPUsers.py from Impacket on Linux automate this process, allowing rapid AS-REP requests for multiple accounts.

Phase 3: Receiving AS-REP Responses:

When the domain controller receives an AS-REQ for an account with pre-authentication disabled, it responds with an AS-REP message without verifying the requester’s identity. This response contains encrypted authentication material encrypted with a key derived from the user’s password, typically using RC4-HMAC encryption (encryption type 0x17), which is approximately 800 times faster to crack than AES-256. The attacker extracts this encrypted blob and formats it for offline password cracking tools.

Phase 4: Offline Hash Cracking:

With the AS-REP hash extracted, the attacker performs offline password cracking on their own infrastructure using GPU-accelerated tools like Hashcat (mode 18200). Modern GPU cracking rigs can test billions of password candidates per hour. Attackers start with dictionary attacks, followed by rule-based attacks, and finally brute-force if necessary. Success depends entirely on password strength—weak passwords fall within seconds, moderate passwords within hours to days.

Phase 5: Credential Usage and Lateral Movement:

Once the password is cracked, the attacker possesses valid domain credentials. These credentials enable legitimate authentication to domain resources and can be used for lateral movement, privilege escalation, data exfiltration, persistence establishment, and further credential harvesting. When the vulnerable accounts are service accounts with elevated privileges, the cracked credentials often provide the foothold needed to progress toward complete domain compromise.

Tools and Techniques to Perform an AS-REP Roasting Attack

Windows-Based Tools

Rubeus is the primary C# toolkit for AS-REP Roasting on Windows systems. This tool automatically identifies and enumerates all domain accounts with pre-authentication disabled, then retrieves their AS-REP hashes

Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

The basic command queries the entire domain and extracts hashes in Hashcat format. Rubeus supports multiple advanced options for operational security and targeted enumeration:

# Specify target user
Rubeus.exe asreproast /user:targetuser /domain:domain.local /dc:192.168.1.1

# Use Kerberos encryption types
Rubeus.exe asreproast /des /format:hashcat

# Enumerate specific Organizational Unit
Rubeus.exe asreproast /ou:"OU=Services,DC=domain,DC=local"

# Use alternate credentials
Rubeus.exe asreproast /creduser:DOMAIN\admin /credpassword:PASSWORD

# Specify target user
Rubeus.exe asreproast /user:targetuser /domain:domain.local /dc:192.168.1.1

# Use Kerberos encryption types
Rubeus.exe asreproast /des /format:hashcat

# Enumerate specific Organizational Unit
Rubeus.exe asreproast /ou:"OU=Services,DC=domain,DC=local"

# Use alternate credentials
Rubeus.exe asreproast /creduser:DOMAIN\admin /credpassword:PASSWORD

Rubeus also supports LDAPS (LDAP over SSL) for secure queries and can output results in both Hashcat and John the Ripper formats.

Linux-Based Tools

Impacket’s GetNPUsers.py is the standard tool for AS-REP Roasting from Linux environments. It operates in both authenticated and unauthenticated modes, making it highly flexible for different scenarios

# Unauthenticated enumeration with RPC null session
impacket-GetNPUsers -no-pass -dc-ip 10.0.0.1 domain.local/

# Enumerate specific users from file
impacket-GetNPUsers -no-pass -usersfile users.txt -dc-ip 10.0.0.1 domain.local/

# Authenticated enumeration and hash extraction
impacket-GetNPUsers domain.local/username:password -request -format hashcat -outputfile hashes.txt

# Using NTLM hash for authentication
impacket-GetNPUsers -hashes 'LM:NT' -dc-ip 10.0.0.1 domain.local/username

# Unauthenticated enumeration with RPC null session
impacket-GetNPUsers -no-pass -dc-ip 10.0.0.1 domain.local/

# Enumerate specific users from file
impacket-GetNPUsers -no-pass -usersfile users.txt -dc-ip 10.0.0.1 domain.local/

# Authenticated enumeration and hash extraction
impacket-GetNPUsers domain.local/username:password -request -format hashcat -outputfile hashes.txt

# Using NTLM hash for authentication
impacket-GetNPUsers -hashes 'LM:NT' -dc-ip 10.0.0.1 domain.local/username

The -request flag initiates TGT requests and extracts crackable hashes, while -format hashcat ensures output compatibility with Hashcat.

CrackMapExec / NetExec

CrackMapExec and its successor NetExec provide integrated LDAP-based AS-REP Roasting capabilities:

# Authenticated enumeration
nxc ldap 192.168.0.104 -u username -p password --asreproast output.txt

# Unauthenticated with userlist
nxc ldap 192.168.0.104 -u users.txt -p '' --asreproast output.txt

# Specify domain controller
nxc ldap 192.168.0.104 -u username -p password --asreproast output.txt -dc-ip 10.0.0.1

# Authenticated enumeration
nxc ldap 192.168.0.104 -u username -p password --asreproast output.txt

# Unauthenticated with userlist
nxc ldap 192.168.0.104 -u users.txt -p '' --asreproast output.txt

# Specify domain controller
nxc ldap 192.168.0.104 -u username -p password --asreproast output.txt -dc-ip 10.0.0.1

Kerbrute

Kerbrute performs username enumeration and pre-authentication detection, providing reconnaissance data before AS-REP Roasting attacks:

# Enumerate valid usernames
kerbrute userenum --dc 10.0.0.1 -d domain.local users.txt

# Manually test pre-authentication with GetTGT
impacket-getTGT.py domain.local/username -no-pass -dc-ip 10.0.0.1

# Enumerate valid usernames
kerbrute userenum --dc 10.0.0.1 -d domain.local users.txt

# Manually test pre-authentication with GetTGT
impacket-getTGT.py domain.local/username -no-pass -dc-ip 10.0.0.1

Password Cracking Tools

Hashcat Mode 18200 (Kerberos 5, etype 23, AS-REP) is the standard for cracking AS-REP hashes. Performance varies significantly based on GPU hardware and encryption type:

# Basic dictionary attack
hashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Rule-based attack with optimizations
hashcat -m 18200 -a 0 hashes.txt rockyou.txt -r best64.rule

# Benchmark GPU performance
hashcat -m 18200 -b

# Basic dictionary attack
hashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Rule-based attack with optimizations
hashcat -m 18200 -a 0 hashes.txt rockyou.txt -r best64.rule

# Benchmark GPU performance
hashcat -m 18200 -b

John the Ripper provides an alternative cracking method with native Kerberos support:

# Crack AS-REP hashes
john --wordlist=rockyou.txt --format=krb5asrep hashes.txt

# Using rules
john --wordlist=rockyou.txt --rules=best64 --format=krb5asrep hashes.txt

# Crack AS-REP hashes
john --wordlist=rockyou.txt --format=krb5asrep hashes.txt

# Using rules
john --wordlist=rockyou.txt --rules=best64 --format=krb5asrep hashes.txt

Detection and Defense Methods

Detection Techniques

Windows Event Log Analysis: Event ID 4768 (Kerberos Authentication Ticket Request) is the primary indicator for AS-REP Roasting detection and should be a critical component of any Kerberos attack monitoring strategy. The security audit log captures all TGT requests, providing valuable intelligence when properly analyzed. Security teams should establish baseline profiles for normal authentication patterns and monitor for deviations that indicate potential AS-REP Roasting activity:

• Pre-Auth Type: 0 – Indicates no pre-authentication was performed; legitimate clients should show higher values (typically 2 for PA-ENC-TIMESTAMP)
• Service Name: krbtgt – The target service for TGT requests; watching for unusual requesters helps identify reconnaissance
• Ticket Encryption Type: 0x17 – RC4-HMAC encryption; should be replaced with 0x12 (AES-256-CTS-HMAC-SHA1-96) in secure environments
• Source IP address – Multiple requests from the same source, especially external IPs, indicate automated enumeration

Suspicious patterns include rapid sequences of 4768 events from a single source querying multiple accounts with Pre-Auth Type 0 and RC4 encryption, unsuccessful AS-REQ attempts followed by successful ones after password cracking, or requests from uncommon hours that deviate from established usage patterns.

LDAP Query Monitoring: Monitor Active Directory and domain controller logs for LDAP queries targeting account attributes that reveal pre-authentication status. Attackers use LDAP reconnaissance to identify vulnerable accounts, searching for the userAccountControl attribute with the DONT_REQ_PREAUTH flag (decimal value 4194304, hexadecimal 0x400000). Tools like PowerView’s Get-DomainUser -PreauthNotRequired cmdlet generate LDAP traffic that can be detected through Directory Services log analysis. Enable Directory Services event logging on domain controllers and monitor for filter patterns that specifically query userAccountControl values. Alert on multiple LDAP queries for this attribute within short time windows, particularly from non-administrative source IPs.

Honeypot Accounts: Deploy decoy user accounts configured with pre-authentication disabled and assigned strong, random passwords that resist practical cracking attempts. These honeypot accounts should have no legitimate business purpose and should never receive legitimate AS-REQ requests. Any authentication attempt targeting these accounts with Pre-Auth Type 0 serves as a high-fidelity detection signal indicating active reconnaissance or exploitation. Place honeypot accounts in organizational units with restricted access and monitor their Event ID 4768 events exclusively. This approach minimizes false positives while maintaining high detection confidence.

Defense Strategies

Enforce Kerberos Pre-Authentication: The most effective and fundamental defense is enabling pre-authentication for all Active Directory accounts. Pre-authentication verification prevents offline hash cracking by requiring users to prove identity before credential material is issued. Use PowerShell to identify and remediate vulnerable accounts across the entire domain:

# Find all accounts without pre-authentication
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth | Select-Object Name, SamAccountName

# Enable pre-authentication for all vulnerable accounts
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} | Set-ADUser -DoesNotRequirePreAuth $false

# Verify remediation
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}

# Find all accounts without pre-authentication
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth | Select-Object Name, SamAccountName

# Enable pre-authentication for all vulnerable accounts
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} | Set-ADUser -DoesNotRequirePreAuth $false

# Verify remediation
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}

Before enabling pre-authentication for service accounts, verify that applications support modern Kerberos authentication. For legacy applications requiring pre-authentication disabled, develop migration plans or implement isolated authentication mechanisms.

Implement Strong Password Policies: Enforce comprehensive password requirements that make offline cracking computationally prohibitive:

• Minimum 25+ characters for service accounts – Even with GPU acceleration, 25-character random passwords require years to crack
• Complexity requirements – Uppercase, lowercase, numbers, special characters reduce dictionary attack effectiveness
• Regular password rotation – Implement 30-90 day rotation cycles for service accounts
• Password history enforcement – Prevent reuse of previous passwords
• Avoid dictionary words – Mandate random generation rather than human-creatable passwords

Apply stricter policies to privileged accounts (domain admins, service accounts, managed service accounts) than standard user accounts.

Disable RC4 Encryption: Transition from RC4-HMAC (encryption type 0x17) to AES-256-CTS-HMAC-SHA1-96 (encryption type 0x12) for all Kerberos tickets. RC4 is approximately 800 times faster to crack than AES-256, making the encryption type itself a significant security lever. Configure the msDS-SupportedEncryptionTypes attribute to enforce AES encryption across the domain

# View current encryption types for an account
Get-ADUser -Identity "targetuser" -Properties msDS-SupportedEncryptionTypes

# Set account to AES only
Set-ADUser -Identity "targetuser" -Replace @{"msDS-SupportedEncryptionTypes"=24}
# 24 = AES128-CTS-HMAC-SHA1-96 (0x08) + AES256-CTS-HMAC-SHA1-96 (0x10) + RC4-HMAC (legacy, for compatibility)

# View current encryption types for an account
Get-ADUser -Identity "targetuser" -Properties msDS-SupportedEncryptionTypes

# Set account to AES only
Set-ADUser -Identity "targetuser" -Replace @{"msDS-SupportedEncryptionTypes"=24}
# 24 = AES128-CTS-HMAC-SHA1-96 (0x08) + AES256-CTS-HMAC-SHA1-96 (0x10) + RC4-HMAC (legacy, for compatibility)

For full security, use value 16 (AES256 only) once legacy compatibility requirements are met.

AS-REP Roasting vs. Kerberoasting: Key Differences

Understanding the distinctions between AS-REP Roasting and Kerberoasting is essential for cybersecurity professionals implementing effective detection and defense strategies. While both attacks exploit Kerberos weaknesses to harvest password hashes, they operate at different stages of the authentication protocol and require different prerequisites, making them complementary techniques in a sophisticated attacker’s arsenal.

Conclusion

AS-REP Roasting represents a significant and persistent threat to Active Directory environments worldwide, particularly when Kerberos pre-authentication is disabled due to legacy application requirements, system migrations, or administrative oversights. The attack’s accessibility—requiring no credentials, minimal technical sophistication, and often no more than standard penetration testing tools—makes it one of the most frequently observed Kerberos-based attacks in both defensive assessments and real-world intrusions. The combination of low barrier to entry, high success rate against weak passwords, and near-complete invisibility during the offline cracking phase makes AS-REP Roasting an especially attractive attack vector for adversaries ranging from unsophisticated threat actors to advanced persistent threat (APT) groups. The attack’s effectiveness stems from the fundamental security principle that disabled security controls create vulnerabilities proportional to their criticality. Pre-authentication is not an optional hardening measure; it is a core component of Kerberos security designed specifically to prevent offline password attacks. Organizations that disable this control, even with justifiable business reasons for legacy application support, accept significant security risk if they lack compensating controls. The problem compounds when organizations maintain inventory gaps—not knowing which accounts have pre-authentication disabled, unable to quantify their exposure, or lacking the confidence to enable pre-authentication due to fear of breaking unknown applications.

The real-world impact of compromised credentials obtained through AS-REP Roasting extends far beyond individual account compromise. Attackers leverage these credentials as initial footholds for sophisticated multi-stage intrusions, using them to conduct lateral movement, escalate privileges, establish persistence through additional credential harvesting or backdoor installation, and ultimately compromise critical business systems and sensitive data. Organizations have reported incidents where AS-REP Roasting success directly enabled ransomware deployment, intellectual property theft, and financial fraud. The financial and reputational consequences of breaches originating from preventable AS-REP Roasting vulnerabilities create strong business justifications for remediation investments. A truly comprehensive defense strategy requires both proactive technical hardening and sustained operational vigilance. Organizations must establish structured remediation programs targeting pre-authentication disabled accounts, treating this as a critical security priority alongside other Kerberos hardening initiatives. Implementation should prioritize immediate pre-authentication enforcement for accounts where business requirements permit, followed by aggressive timelines for migrating or eliminating accounts requiring pre-authentication disabled status. Simultaneously, organizations must implement strong password policies specifically for service accounts and legacy application accounts—these accounts often carry elevated privileges and attract disproportionate attacker focus. The transition from RC4 to AES encryption should begin immediately for systems supporting modern encryption, as this single change makes AS-REP hash cracking computationally prohibitive. Continuous monitoring through SIEM platforms, behavioral analytics, and specialized Active Directory security tools provides real-time detection capabilities and forensic visibility for incident response.

Only through this integrated approach combining preventive technical controls, operational vigilance, continuous monitoring, and sustained organizational commitment can enterprises effectively defend against AS-REP Roasting and related Kerberos attacks. The threat landscape continues evolving as attackers develop more sophisticated variations and integrate Kerberos attacks into larger intrusion frameworks, making defense an ongoing security imperative rather than a one-time remediation project. Security leaders should treat Kerberos attack surface reduction as a strategic identity security initiative, not merely a compliance checkbox, given the foundational role Active Directory plays in enterprise security infrastructure.

• Critical CUPS Vulnerability (CVE 9.9) in Linux
• What is Silver Ticket Attack: A Comprehensive Guide
• Top 8 Brute Force Tools and Reverse Brute Force Methods
• What is Kerberoasting Attack – Kerberoasting: A Comprehensive Guide
• Deep Dive CVE-2026-40138: Pre-Authentication Authentication Bypass in BeyondTrust Remote Access Solutions

• viperone.gitbook.io: AS-REP Roasting
• attack.mitre.org: Steal or Forge Kerberos Tickets: AS-REP Roasting
• vaadata: Active Directory Monitoring: LDAP Log Analysis and ELK Rules
• splunk: Detecting Active Directory Kerberos Attacks: Threat Research Release