AS-REProasting
Description
The AS-REProasting attack is similar to the Kerberoasting attack; we can obtain crackable hashes for user accounts that have the property Do not require Kerberos preauthentication enabled. The success of this attack depends on the strength of the user account password that we will crack.
Attack
To get the crackable hashes we will use Rufeus again.
However, this time, we will use the asreproast action. If we don't specify a name, Rubeus will extract hashes for each user that has Kerberos preauthentication not required
extract hashes for each user that has "Kerberos preauthentication" not required
Once we get the Rubeus file it will be placed in Downloads by default. Move the files to our kali machine via smb (shown n the second lesson)
Hashcad edit for cracking the hash
Now for hashcat to reckgodnize this hash, we need to add $23 after $krb5asrep`
We can now use hashcat with the hash-mode (option -m) 18200 for AS-REPRoastable hashes. We also pass a dictionary file with passwords (the file passwords.txt) and save the output of any successfully cracked tickets to the file asrepcracked.txt
Crack hash
Open the output file and see the password at the end of the doc
Prevention
Only enable "Do not require Kerberos preauthentication" if absolutely necessary.
Review user accounts quarterly to remove this setting if not needed.
Regular users with this setting often have weak passwords – easy to crack.
For required cases, enforce a 20+ character password policy.
Detection
When we executed Rubeus, an Event with ID
4768was generated, signaling that aKerberos Authentication ticketwas generatedThis ID is created for every ticket kerberos creates so it will be a lot of this ID
You can track source IPs to detect unusual authentication behavior.
Alert on logins from unexpected VLANs to catch potential attacks.
Honeypot
Honeypot users are fake accounts with no real use—any login attempt is suspicious.
If it’s the only account without Kerberos Pre-Authentication, attackers may recognize and avoid it.
Old & Inactive – Use an aged, unused account to avoid suspicion.
Password Age – Service accounts: 2+ years old, Regular accounts: less than 1 year.
Login History – Ensure some login history after the last password change.
Minimal Privileges – Assign some privileges to make the account interesting for attackers.
Task
The tasks are done the same principe as the kerberoasting lesson.
Last updated