ASREPRoasting: The Attack That Works Without Any Domain Credentials

#Pre-Authentication Is Optional. That's the Whole Vulnerability.#link

Kerberos pre-authentication exists to prevent exactly this attack. When enabled, the user must encrypt a timestamp with their password before the KDC issues a TGT. The KDC decrypts it, validates the password, then responds. If pre-auth is disabled on an account, anyone can request an AS-REP for that user and receive a TGT encrypted with the account's password hash. No authentication required. No credentials needed. Just the username.

Why would anyone disable pre-auth? Vendor documentation. SQL Server installation guides from 2012. Exchange setup docs. SAP configuration manuals. They all say "set the Do not require Kerberos preauthentication flag on the service account." Admins follow the guide, check the box, and forget about it. Years later, you find that account with GetNPUsers.py and crack it in seconds.

How do you find accounts without pre-authentication?

One account: mmorgan. A Domain Admin (we saw this earlier in the recursive group membership check). Pre-auth disabled. Password never expires. This is a gift-wrapped domain compromise. And the best part? You don't even need to be authenticated to exploit it.

Can you perform this from Linux without any credentials?

No password. No hash. No Kerberos ticket. Just a username list and network access to port 88. GetNPUsers.py iterates through the list, and for any account with pre-auth disabled, it retrieves the AS-REP hash. The rest go through rockyou.txt in Hashcat.

Two Kerberos attacks down. Both exploit weak passwords on privileged accounts. Both are detectable via Event ID 4768/4769 monitoring. Both are mitigated by strong passwords and removing unnecessary SPNs/pre-auth exemptions. But the next attack doesn't need weak passwords at all. It abuses permissions. ACLs. The silent killer of Active Directory security.