ADKERB-003: Cuentas vulnerables a AS-REP Roasting
- Plataforma
- Active Directory
- Categoría
- AD Kerberos Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las cuentas con el indicador DONT_REQUIRE_PREAUTH permiten a cualquier usuario solicitar un AS-REP con material cifrado que puede romperse sin conexión y sin autenticación previa. A diferencia del Kerberoasting, el AS-REP Roasting en algunas configuraciones ni siquiera requiere una cuenta válida del dominio, lo que lo convierte en una técnica de acceso inicial atractiva para atacantes con solo acceso de red a un controlador de dominio.
Por qué importa
Kerberos pre-authentication exists specifically to prevent offline password cracking of AS exchanges. When DONT_REQ_PREAUTH is set, the KDC responds to a bare AS-REQ with a full AS-REP whose encrypted timestamp portion (the enc-part of the ticket-granting-ticket and the enc-part of the response) is sealed with the long-term key of the target account, which is derived deterministically from the accounts password. The attacker never has to send a single correct credential to the KDC. They do not need to authenticate. In some configurations (any DC reachable over TCP/UDP 88 from a non-domain-joined host or even from the internet via misconfigured perimeter), they do not even need to be on the corporate network. The attack scales: a single Kerberos request per target yields a hash that can be cracked at hundreds of millions of guesses per second on commodity GPU hardware for RC4, and tens of millions per second for AES. Service accounts, contractor accounts, and legacy Unix-integration accounts are common targets because administrators historically set DONT_REQ_PREAUTH to support older Kerberos clients that did not implement pre-authentication. Any successful crack yields a domain credential with whatever privileges the account holds, frequently service-tier access or, in older environments, Domain Admin.
Ruta de ataque
1. Enumerate AS-REP roastable accounts. The attacker queries LDAP (if they have any authenticated foothold) using the same userAccountControl bit-test, or runs an unauthenticated discovery: Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt. With Impacket the equivalent is GetNPUsers.py corp.contoso.com/ -usersfile users.txt -format hashcat -outputfile asrep.txt. The Impacket variant works with no domain credentials at all when given a username list, because GetNPUsers issues an AS-REQ without pre-authentication and observes the response. 2. Optionally, harvest a username list. The attacker can scrape the GAL via OWA, use kerbrute userenum against the KDC (which fingerprints valid usernames by the KDCs KRB5KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN responses), or pull names from public sources (LinkedIn, GitHub commits, leaked breach data). 3. Trigger the AS exchange. For each candidate, the attacker sends an AS-REQ with no PA-ENC-TIMESTAMP. If DONT_REQ_PREAUTH is set, the KDC returns a complete AS-REP. Rubeus and GetNPUsers both serialize the encrypted blob into hashcat mode 18200 format: $krb5asrep$23$user@DOMAIN:<checksum>$<encrypted>. 4. Crack offline. hashcat -m 18200 asrep.txt rockyou.txt -r best64.rule. RC4-HMAC AS-REPs crack at hundreds of millions of guesses per second on a single modern GPU. AES variants (mode 19900 for AES256) are slower but still tractable for weak passwords. Mandiant reports describe operators cracking AS-REP hashes in minutes against any password not in the top 10M of leaked corpora. 5. Authenticate. The cracked plaintext password (or its RC4/AES key) is used to authenticate as the target via kinit, runas /netonly, Rubeus asktgt, or by setting credentials in any Kerberos-aware tool. The attacker now has a real domain identity with full Kerberos and NTLM authentication rights, indistinguishable on the wire from the legitimate user. 6. Pivot and persist. Where the cracked account has privileged group membership, the attacker proceeds directly to DCSync, krbtgt extraction, or lateral movement. Where the account is a low-privileged user, the attacker uses it as a foothold for BloodHound collection, Kerberoasting (ADKERB-002), and ACL abuse (ADACL-001 family).
Cómo lo evalúa Guerrilla
Guerrilla performs a single LDAP bit-test query against the configured forest, using the LDAP_MATCHING_RULE_BIT_AND OID against userAccountControl. The filter is: (&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304)) This is the same filter PowerView, BloodHound, and ADRecon use to identify roastable accounts and is identical to Get-ADUser -Filter "DoesNotRequirePreAuth -eq $true" on the AD PowerShell module. Guerrilla then enriches each result with: enabled state (ACCOUNTDISABLE bit clear), pwdLastSet age, lastLogonTimestamp age, group memberships including adminCount=1 indicators, registered servicePrincipalName values (an account that is both AS-REP roastable and Kerberoastable is a double finding), and msDS-SupportedEncryptionTypes to surface RC4-only accounts. The check requires only authenticated LDAP read of the domain NC; no privileged rights are needed, which mirrors what an attacker with any domain foothold sees. For environments running with Active Directory Web Services available, the equivalent native cmdlet is Get-ADUser -Filter "DoesNotRequirePreAuth -eq $true -and Enabled -eq $true" -Properties DoesNotRequirePreAuth, pwdLastSet, lastLogonTimestamp, msDS-SupportedEncryptionTypes.
Valor recomendado
Ninguna cuenta con el indicador 'No pedir autenticación previa de Kerberos'. Cero cuentas vulnerables a AS-REP Roasting.
Remediación
Identifica las cuentas con Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true -and Enabled -eq $true}. Habilita la autenticación previa de Kerberos en todas las cuentas. Rara vez hay una razón legítima para deshabilitarla en entornos modernos. Rota las contraseñas de todas las cuentas antes vulnerables, porque pueden haber sido ya atacadas. Vigila el Event ID 4768 con tipo de autenticación previa 0.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- ANSSI
- R36
- CIS AD Benchmark
- 7.2.1
- MITRE ATT&CK
- T1558.004