ad-kerberoastinglisted

# Kerberoasting & AS-REP roasting ## When it applies You have valid domain credentials (kerberoasting) or just a username list (AS-REP). Both recover plaintext passwords offline by cracking Kerberos-issued material — no lockout risk. ## Why it works - **Kerberoasting**: any authenticated user can request a service ticket (TGS) for any account with an SPN; part of it is encrypted with the service account's password hash. Crack it offline. - **AS-REP roasting**: accounts with "do not require Kerberos preauth" hand out an AS-REP encrypted with the user's key to *anyone* — no creds needed, just the username. ## Method 1. **Kerberoast** (need creds): `impacket-GetUserSPNs corp.local/user:pass -dc-ip DC -request` (or `nxc ldap DC -u user -p pass --kerberoasting out.txt`). Service accounts are prime targets. 2. **AS-REP roast** (no creds needed): `impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -request` — pulls hashes for pre-auth-disabled accounts. 3. **Crack offline**: `hashcat -m 13100` (TGS) / `-m 18200` (AS-REP) with `rockyou` + rules. 4. **Use the creds**: service accounts are often privileged → lateral movement / DA path (`ad-pivot-arsenal`, `network-pivoting-tunneling`). ## Gotchas - Offline cracking = no account lockout, but a weak-password dependency; strong passwords resist. - Target high-value SPNs (SQL, web, admin service accounts) first. - Clock skew breaks Kerberos — sync time to the DC (`ntpdate`/`faketime`) if you get KRB_AP_ERR_SKEW.