AS-REP roasting: accounts without pre-authentication

Normally Kerberos requires pre-authentication: you prove you know the password before the KDC responds. Some accounts have this requirement disabled (DONT_REQ_PREAUTH).

The attack

For those accounts, anyone can request an AS-REP: the KDC replies with a portion encrypted with the key derived from the password. It is cracked offline, without touching the account.

impacket-GetNPUsers dom/ -usersfile users.txt -no-pass
hashcat -m 18200 asrep.txt wordlist.txt

Similar to Kerberoasting but you do not even need a valid account, only the list of vulnerable users.

Defence

Do not disable pre-authentication (audit DONT_REQ_PREAUTH across the domain). Long, random passwords. AES instead of RC4. Monitor AS-REP requests without pre-auth.