AS-REP Roasting Attack
AS-REP Roasting Attack
Windows 2008 R2
Introduction
AS-REP Roasting is an attack against authentication using the Kerberos protocol, with the aim of exploiting Kerberos vulnerabilities to obtain user credentials in the Active Directory.
Kerberos is a network authentication protocol used to securely verify users and services on computer networks. The Kerberos protocol uses tickets to verify user identity. In Active Directory, user credentials include a password hash and an AES key for KERBEROS.
AS-REP Roasting exploits a vulnerability in the Kerberos protocol, which allows attackers to collect AS-REP responses by sending invalid authentication requests (AS-REQ) in certain circumstances. The AS-REP response contains the user's encrypted AES key, which attackers can use to crack the password hash and obtain user credentials.
sequenceDiagram
participant Attacker
participant DomainController
participant Victim
Attacker ->> DomainController: Send invalid authentication request (AS-REQ)
DomainController -->> Attacker: Send authentication error (KRB5KDC_ERR_PREAUTH_REQUIRED)
Attacker ->> Victim: Send AS-REQ request, requesting no preauthentication
Victim -->> Attacker: Send AS-REP response containing the user's encrypted AES key
Attacker ->> DomainController: Attempt to crack password hash using the encrypted AES key
DomainController -->> Attacker: Send password hash
Environment Setup
If the domain user has the option "Do not require Kerberos preauthentication" set, this option is typically not enabled by default.
漏洞利用
rubeus
To obtain a hash using Rubeus.exe
powershell
To find users in the domain who have "Do not require Kerberos preauthentication"
To obtain the hash returned by AS-REP, use ASREPRoast.ps1 in Markdown format.
impacket
User Brute-Forcing
Obtaining Ticket Information for a Specific User
Hash Cracking
john
hashcat
Log Analysis
Windows event ID 4768 is the event ID for the Kerberos authentication service, which is used to record events of Kerberos authentication requests. This event ID usually does not indicate an attack by itself, but if you notice an abnormal amount or unauthorized Kerberos authentication requests, it may indicate an attack.
Last updated