Skip to content
attack.paths
Connexion
← RegistryDossier · 8 steps · 7 edges

AS-REP roast → cracked user → Kerberoast → service-account admin

Anonymous attacker recovers a user password via AS-REP roasting, authenticates, kerberoasts a service account with weak password, and lands on a high-value server.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: at least one account has DONT_REQUIRE_PREAUTH (UF_DONT_REQUIRE_PREAUTH) set, and at least one SPN-bearing service account uses a crackable password. Anonymous LDAP enumeration is allowed (or a single user is known).

§ Steps

  1. 01
    KerberoastingCredential Access
    T1558.003— Kerberoasting

    GetUserSPNs.py -request <domain>/<user>

  2. 02
    Dump LSASS / cached DA hashCredential Access
    T1003.001— LSASS Memory
  3. 03
    Pivot via service accountInitial Access
    T1078— Valid Accounts

    Often a local admin on the target service host.

  4. 04
    Authenticate as userInitial Access
    T1078— Valid Accounts
  5. 05
    Crack TGS hashesCredential Access
    T1110— Brute Force

    hashcat -m 13100 — service-account passwords are often weaker than user passwords.

  6. 06
    Offline hash crackCredential Access
    T1110— Brute Force

    hashcat -m 18200 -a 0 hashes.txt rockyou.txt

  7. 07
    AS-REP RoastingCredential Access
    T1558.004— AS-REP Roasting

    GetNPUsers.py <domain>/ -no-pass -usersfile users.txt

  8. 08
    User enumerationDiscovery
    T1087.002— Domain Account Discovery

    kerbrute userenum / rpcclient enumdomusers — list candidate accounts.

§ References

§ Frequently asked

What is the "AS-REP roast → cracked user → Kerberoast → service-account admin" attack path?
Anonymous attacker recovers a user password via AS-REP roasting, authenticates, kerberoasts a service account with weak password, and lands on a high-value server. It chains 8 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Kerberoasting (T1558.003) — a credential access primitive. Assumed environment: at least one account has DONT_REQUIRE_PREAUTH (UF_DONT_REQUIRE_PREAUTH) set, and at least one SPN-bearing service account uses a crackable password.
What is the final impact of this kill-chain?
The final step lands on User enumeration (T1087.002), which falls under Discovery. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers