AS-REP roasting is a technique that allows retrieving password hashes for users that have the Do not require Kerberos preauthentication property selected:
Those hashes can then be cracked offline, similarly to how it's done in T1208: Kerberoasting.
Execution and cracking process
1
Gather AS-REP hashes using Rubeus
Run Rubeus to request AS-REP hashes for accounts without Kerberos preauthentication:
Example output screenshot:
2
Prepare the hash for Hashcat and crack it
Example AS-REP hash returned:
Insert 23 after $krb5asrep$ to match Hashcat's expected format (for AES-256-CTS-HMAC-SHA1-96):
Crack with Hashcat (example using mask/wordlist attack):
