ADKERB-003: AS-REP Roastable Accounts
- Platform
- Active Directory
- Category
- AD Kerberos Security
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check runs an LDAP query against the domain naming context for every user and computer object matching: (&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) The matching rule 1.2.840.113556.1.4.803 is LDAP_MATCHING_RULE_BIT_AND. 4194304 (0x400000) is the DONT_REQ_PREAUTH flag (UF_DONT_REQUIRE_PREAUTH). The trailing negative term excludes accounts where ACCOUNTDISABLE (0x2) is set, since disabled accounts cannot be roasted. For each match the check captures sAMAccountName, distinguishedName, pwdLastSet, lastLogonTimestamp, memberOf, adminCount, and servicePrincipalName so the analyst can immediately judge blast radius (e.g., is this a stale account, a service account, or a Domain Admin). The check also reports the Kerberos encryption types advertised by the account through msDS-SupportedEncryptionTypes, because an AS-REP encrypted with RC4-HMAC (etype 23) cracks orders of magnitude faster than one encrypted with AES256-CTS-HMAC-SHA1-96 (etype 18).
Why it matters
Kerberos pre-authentication exists specifically to prevent offline password cracking of AS exchanges. When DONT_REQ_PREAUTH is set, the KDC responds to a bare AS-REQ with a full AS-REP whose encrypted timestamp portion (the enc-part of the ticket-granting-ticket and the enc-part of the response) is sealed with the long-term key of the target account, which is derived deterministically from the accounts password. The attacker never has to send a single correct credential to the KDC. They do not need to authenticate. In some configurations (any DC reachable over TCP/UDP 88 from a non-domain-joined host or even from the internet via misconfigured perimeter), they do not even need to be on the corporate network. The attack scales: a single Kerberos request per target yields a hash that can be cracked at hundreds of millions of guesses per second on commodity GPU hardware for RC4, and tens of millions per second for AES. Service accounts, contractor accounts, and legacy Unix-integration accounts are common targets because administrators historically set DONT_REQ_PREAUTH to support older Kerberos clients that did not implement pre-authentication. Any successful crack yields a domain credential with whatever privileges the account holds, frequently service-tier access or, in older environments, Domain Admin.
Attack path
1. Enumerate AS-REP roastable accounts. The attacker queries LDAP (if they have any authenticated foothold) using the same userAccountControl bit-test, or runs an unauthenticated discovery: Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt. With Impacket the equivalent is GetNPUsers.py corp.contoso.com/ -usersfile users.txt -format hashcat -outputfile asrep.txt. The Impacket variant works with no domain credentials at all when given a username list, because GetNPUsers issues an AS-REQ without pre-authentication and observes the response. 2. Optionally, harvest a username list. The attacker can scrape the GAL via OWA, use kerbrute userenum against the KDC (which fingerprints valid usernames by the KDCs KRB5KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN responses), or pull names from public sources (LinkedIn, GitHub commits, leaked breach data). 3. Trigger the AS exchange. For each candidate, the attacker sends an AS-REQ with no PA-ENC-TIMESTAMP. If DONT_REQ_PREAUTH is set, the KDC returns a complete AS-REP. Rubeus and GetNPUsers both serialize the encrypted blob into hashcat mode 18200 format: $krb5asrep$23$user@DOMAIN:<checksum>$<encrypted>. 4. Crack offline. hashcat -m 18200 asrep.txt rockyou.txt -r best64.rule. RC4-HMAC AS-REPs crack at hundreds of millions of guesses per second on a single modern GPU. AES variants (mode 19900 for AES256) are slower but still tractable for weak passwords. Mandiant reports describe operators cracking AS-REP hashes in minutes against any password not in the top 10M of leaked corpora. 5. Authenticate. The cracked plaintext password (or its RC4/AES key) is used to authenticate as the target via kinit, runas /netonly, Rubeus asktgt, or by setting credentials in any Kerberos-aware tool. The attacker now has a real domain identity with full Kerberos and NTLM authentication rights, indistinguishable on the wire from the legitimate user. 6. Pivot and persist. Where the cracked account has privileged group membership, the attacker proceeds directly to DCSync, krbtgt extraction, or lateral movement. Where the account is a low-privileged user, the attacker uses it as a foothold for BloodHound collection, Kerberoasting (ADKERB-002), and ACL abuse (ADACL-001 family).
How Guerrilla assesses it
Guerrilla performs a single LDAP bit-test query against the configured forest, using the LDAP_MATCHING_RULE_BIT_AND OID against userAccountControl. The filter is: (&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304)) This is the same filter PowerView, BloodHound, and ADRecon use to identify roastable accounts and is identical to Get-ADUser -Filter "DoesNotRequirePreAuth -eq $true" on the AD PowerShell module. Guerrilla then enriches each result with: enabled state (ACCOUNTDISABLE bit clear), pwdLastSet age, lastLogonTimestamp age, group memberships including adminCount=1 indicators, registered servicePrincipalName values (an account that is both AS-REP roastable and Kerberoastable is a double finding), and msDS-SupportedEncryptionTypes to surface RC4-only accounts. The check requires only authenticated LDAP read of the domain NC; no privileged rights are needed, which mirrors what an attacker with any domain foothold sees. For environments running with Active Directory Web Services available, the equivalent native cmdlet is Get-ADUser -Filter "DoesNotRequirePreAuth -eq $true -and Enabled -eq $true" -Properties DoesNotRequirePreAuth, pwdLastSet, lastLogonTimestamp, msDS-SupportedEncryptionTypes.
Recommended value
No accounts with 'Do not require Kerberos preauthentication' flag set. Zero AS-REP Roastable accounts
Remediation
Identify accounts using Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true -and Enabled -eq $true}. Enable Kerberos pre-authentication on all accounts. There is rarely a legitimate reason to disable pre-authentication in modern environments. Rotate passwords on all previously vulnerable accounts as they may have already been targeted. Monitor for Event ID 4768 with pre-authentication type 0
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-5(1)
- ANSSI
- R36
- CIS AD Benchmark
- 7.2.1
- MITRE ATT&CK
- T1558.004