AS-REP Named

AS-REP roast names accounts without preauth — recognize class on $LAB_AD; defenders require preauth and strong passwords.

AS-REP Named• Audio Walkthrough

00:00/03:18

Visual · t25_asrep_named

AS-REP class literacy. $LAB_AD only. Original Cyberlium.

AS-REP roast targets 'Do not require Kerberos preauthentication' — name the misconfig, do not roast strangers.

AS-REP roast class: attacker requests AS-REP for accounts with UF_DONT_REQUIRE_PREAUTH, receives encrypted AS-REP offline-crackable without initial password proof. Misconfiguration or legacy compatibility causes exposure — defenders audit for flag and enforce preauth. Cyberlium names AS-REP class with mitigations on YOUR $LAB_AD — require preauth, strong passwords, monitor 4768 anomalies — not Impacket GetNPUsers recipes against unauthorized domains. Next: PtH/PtT Named.

1. AS-REP class (named, no cookbook)

Account flag: preauthentication not required. Attack class: obtain AS-REP ciphertext for offline crack. Often found on legacy or misconfigured service accounts — rare in hardened tenants when audited.

On $LAB_AD, document class card with flag name and audit habit — no GetNPUsers command lines against stranger forests.

Command guide

Try these commands — AS-REP class (named, no cookbook)

═══ WINDOWS / POWERSHELL (Lab AD) ═══

Audit user accounts that have Kerberos Pre-Authentication disabled (vulnerable to AS-REP)

Command — copy this

Get-ADUser -Filter 'DoesNotRequirePreAuth -eq $true' -Properties DoesNotRequirePreAuth | Select-Object SamAccountName, Enabled

Remediation: Ensure pre-authentication is enforced on all standard accounts

Optional command

Set-ADAccountControl -Identity "labuser" -DoesNotRequirePreAuth $false

═══ DEFENDER AUDITING ═══ Monitor Event ID 4768 (TGT Request) with Pre-Authentication type 0 (Failed/None)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4768} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-List TimeCreated, Message

Primary tools to practice this lesson: curl, grep. Reference sites: MITRE T1558.004 AS-REP Roasting (https://attack.mitre.org/techniques/T1558/004/); Microsoft pre-auth (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Defender mitigations

Ensure 'Account is sensitive and cannot be delegated' and preauth required for all non-exception accounts. Audit LDAP for DONT_REQ_PREAUTH. Strong password policy. Monitor 4768 for anomalous AS-REQ without preauth success patterns.

Remove flag from any account unless documented exception with compensating controls.

3. Refusal boundary

Forbidden: AS-REP roast walkthrough on production. Allowed: finding template 'AS-REP class — account svc_legacy lacks preauth — enforce preauth' for $LAB_AD purple notes.

Ship: AS-REP class card — flag, class flow, three mitigations. Next: PtH/PtT Named.

4. What you ship: AS-REP class card for $LAB_AD

Class definition, UF_DONT_REQUIRE_PREAUTH note, mitigations. NO GetNPUsers recipes. chmod 600.

5. What you record before the next lesson

Date. AS-REP card. $LAB_AD named. File t25-m05-l02-asrep-named.txt chmod 600.

6. Wrong vs right: stranger-domain attacks vs lab AD literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Roast AS-REP on employer AD. Share cracked AS-REP hashes publicly.
Right: Write AS-REP class card with mitigations for YOUR $LAB_AD. Next: PtH/PtT Named.

Hands-on Exercise