Summary
How I AES-Roasted My Active Directory Lab (And How to Fix It) AS-REP Roasting is one of the easiest ways to obtain Active Directory credentials without knowing a password. If a user has Kerberos Preauthentication disabled, the Domain Controller returns an AS-REP response that can be cracked offline. In this lab, I’ll show how I found a vulnerable account, cracked its password, and authenticated to the domain. Lab
- Domain: lab.local
- DC: 192.168.56.104
- Attacker: Kali Linux
Step 1 — Guess Usernames
The first step is getting valid usernames.
In a real environment, these could come from LinkedIn, company emails, or OSINT. For this lab, I created a simple users.txt
file.
Step 2 — Find Vulnerable Accounts
I used GetNPUsers.py to check whether any user has Kerberos preauthentication disabled.
GetNPUsers.py lab.local/ -usersfile users.txt -dc-ip 192.168.56.104 -no-pass
If an account is vulnerable, Impacket returns an AS-REP hash.
Get Aruvasaga chithan A’s stories in your inbox
Join Medium for free to get updates from this writer.
In my lab, the account svc_sql was vulnerable.
Step 3 — Crack the Hash
Next, I saved the hash into hash.txt
and cracked it with Hashcat.
hashcat -m 18200 hash.txt /home/
/Desktop/GOAD-LAB/GOAD/common-password-list/rockyou.txt Hashcat recovered the password: svc_sql : password@123 Since this is an offline attack, the Domain Controller never sees the password guesses. Step 4 — Verify the Credentials Finally, I verified the recovered password using NetExec. netexec smb 192.168.56.104 -u svc_sql -p ‘password@123’ Authentication was successful, confirming the credentials were valid. Why Does This Work? The account had “Do not require Kerberos Preauthentication” enabled. Because of this, the Domain Controller returned an encrypted AS-REP response without asking for a password, allowing it to be cracked offline. If we disable “Do not require Kerberos Preauthentication” will get output like this: How to Prevent AS-REP Roasting
- Enable Kerberos Preauthentication 2.Use strong passwords for service accounts
- Use Group Managed Service Accounts (gMSA)
- Regularly audit accounts with preauthentication disabled
- Monitor Kerberos authentication events Disclaimer: This article is written entirely for educational purposes and to help Active Directory administrators better defend their environments against advanced Kerberos attacks. The AES-Roasting attack showcased here was conducted in a controlled, self-hosted lab environment. Unsanctioned exploitation of these techniques on live, production systems without explicit authorization is strictly against the law. The author is not responsible for any malicious use of this material. — Written by Aruvasaga Chithan A Ethical Hacker & Cyber Security Researcher. Thanks for reading — your support keeps me writing. See you in the next article…