Active › Module 5 › Lesson 2
AS-REP Named
AS-REP roast names accounts without preauth — recognize class on $LAB_AD; defenders require preauth and strong passwords.
Visual · t25_asrep_named
AS-REP class literacy. $LAB_AD only. Original Cyberlium.
Opening
AS-REP roast targets 'Do not require Kerberos preauthentication' — name the misconfig, do not roast strangers.
AS-REP roast class: attacker requests AS-REP for accounts with UF_DONT_REQUIRE_PREAUTH, receives encrypted AS-REP offline-crackable without initial password proof. Misconfiguration or legacy compatibility causes exposure — defenders audit for flag and enforce preauth. Cyberlium names AS-REP class with mitigations on YOUR $LAB_AD — require preauth, strong passwords, monitor 4768 anomalies — not Impacket GetNPUsers recipes against unauthorized domains. Next: PtH/PtT Named.
1. AS-REP class (named, no cookbook)
Account flag: preauthentication not required. Attack class: obtain AS-REP ciphertext for offline crack. Often found on legacy or misconfigured service accounts — rare in hardened tenants when audited.
On $LAB_AD, document class card with flag name and audit habit — no GetNPUsers command lines against stranger forests.
Command guide
Try these commands — AS-REP class (named, no cookbook)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE T1558.004 AS-REP Roasting — https://attack.mitre.org/techniques/T1558/004/ (named literacy) Microsoft pre-auth — https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview (Kerberos pre-auth) CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/asrep-named.txt" <<'EOF'
AS-REP roasting: accounts with DONT_REQ_PREAUTH — named for detection
Defender: audit UF_DONT_REQUIRE_PREAUTH, enforce pre-auth
NEVER: Impacket GetNPUsers / attack scripts against stranger domains
EOFCommand — copy this
grep -E 'AS-REP|Defender|NEVER' "$LAB_AD/notes/asrep-named.txt" curl -sS https://attack.mitre.org/techniques/T1558/004/ | head -8
Primary tools to practice this lesson: curl, grep. Reference sites: MITRE T1558.004 AS-REP Roasting (https://attack.mitre.org/techniques/T1558/004/); Microsoft pre-auth (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender mitigations
Ensure 'Account is sensitive and cannot be delegated' and preauth required for all non-exception accounts. Audit LDAP for DONT_REQ_PREAUTH. Strong password policy. Monitor 4768 for anomalous AS-REQ without preauth success patterns.
Remove flag from any account unless documented exception with compensating controls.
3. Refusal boundary
Forbidden: AS-REP roast walkthrough on production. Allowed: finding template 'AS-REP class — account svc_legacy lacks preauth — enforce preauth' for $LAB_AD purple notes.
Ship: AS-REP class card — flag, class flow, three mitigations. Next: PtH/PtT Named.
4. What you ship: AS-REP class card for $LAB_AD
Class definition, UF_DONT_REQUIRE_PREAUTH note, mitigations. NO GetNPUsers recipes. chmod 600.
5. What you record before the next lesson
Date. AS-REP card. $LAB_AD named. File t25-m05-l02-asrep-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Roast AS-REP on employer AD. Share cracked AS-REP hashes publicly.
Right
Write AS-REP class card with mitigations for YOUR $LAB_AD. Next: PtH/PtT Named.
Mission: name AS-REP class
1) Define preauth requirement in one sentence. 2) Name the vulnerable flag. 3) List three mitigations. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Periodic LDAP audit for DONT_REQ_PREAUTH catches legacy drift.
Knowledge Check
APPLY: AS-REP literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Accounts without Kerberos preauth enable AS-REP roast class.
True or False
Knowledge Check
APPLY: Defender fix for AS-REP class:
Multiple choice