Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography. Developed at the Massachusetts Institute of Technology (MIT) in the 1980s, Kerberos has become the de facto standard for authentication in Windows Active Directory environments and is also widely used in UNIX and Linux systems. Its primary goal is to enable secure identity verification over insecure networks, minimizing the risk of credential theft and replay attacks.

Kerberos is based on the concept of tickets, which are time-stamped authentication tokens that allow users to prove their identity to network services without transmitting passwords over the network. For more details, refer to the MIT Kerberos Project.

The Kerberos protocol relies on several core components:

• Key Distribution Center (KDC): The trusted authority that issues authentication tickets. It consists of two logical parts:
  • Authentication Service (AS): Verifies user credentials and issues Ticket Granting Tickets (TGTs).
  • Ticket Granting Service (TGS): Issues service tickets for access to specific network resources.
• Client: The user or system requesting access to network resources.
• Server: The resource or service the client wants to access.
• Tickets: Encrypted tokens used to authenticate users and grant access to services.

The typical Kerberos authentication flow involves the following steps:

1. Initial Authentication: The client sends a request to the AS for a TGT. The AS verifies the client’s credentials and issues a TGT encrypted with the client’s secret key.
2. Ticket Granting: The client uses the TGT to request a service ticket from the TGS. The TGS validates the TGT and issues a service ticket.
3. Service Access: The client presents the service ticket to the target server, which validates it and grants access.

This process ensures that credentials are never directly transmitted over the network, reducing the risk of interception. For a detailed protocol breakdown, see the IETF RFC 4120.

AS-REP Roasting is a post-exploitation attack technique that targets Kerberos accounts configured without pre-authentication. By exploiting this misconfiguration, attackers can obtain encrypted authentication responses (AS-REP) from the KDC, which can then be cracked offline to recover user passwords. This attack is particularly dangerous because it does not require valid credentials or elevated privileges to execute.

The term “roasting” refers to the process of extracting and attempting to crack cryptographic material (in this case, the AS-REP) to recover plaintext credentials. AS-REP Roasting is similar in concept to Kerberoasting, but it targets different aspects of the Kerberos protocol.

Kerberos supports an optional security feature called pre-authentication, which requires users to prove their identity before the KDC issues a TGT. However, if pre-authentication is disabled for an account, the KDC will respond to any authentication request with an AS-REP encrypted with the user’s password hash. Attackers can request AS-REP messages for such accounts and attempt to crack the hash offline, potentially gaining unauthorized access.

This vulnerability arises from legacy configurations or deliberate settings for service accounts, making it a valuable target for attackers seeking lateral movement within a network.

While both AS-REP Roasting and Kerberoasting are Kerberos ticket-based attacks, there are key differences:

• AS-REP Roasting: Targets user accounts with pre-authentication disabled. Attackers request AS-REP responses directly from the KDC.
• Kerberoasting: Targets service accounts with Service Principal Names (SPNs). Attackers request service tickets from the TGS, which are encrypted with the service account’s password hash.
• Privilege Requirements: AS-REP Roasting can be performed by any authenticated user or, in some cases, even unauthenticated users, while Kerberoasting requires at least domain user access.

For a technical comparison, refer to MITRE ATT&CK: AS-REP Roasting and Kerberoasting.

In Active Directory, the UserAccountControl attribute determines various account properties. The flag DONT_REQ_PREAUTH (value 4194304) disables Kerberos pre-authentication for an account. When this flag is set, the KDC will issue an AS-REP response to any authentication request for that account, regardless of the requestor’s identity.

Attackers often enumerate accounts with this flag set using LDAP queries or tools like PowerView:

Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth

Accounts with pre-authentication disabled are prime targets for AS-REP Roasting. For more on account flags, see Microsoft UserAccountControl documentation.

Once an attacker identifies vulnerable accounts, they can send an authentication request to the KDC for each target. The KDC responds with an AS-REP message encrypted with the user’s password hash. Tools such as Impacket’s GetNPUsers.py or Rubeus automate this process:

python GetNPUsers.py domain.local/ -usersfile users.txt -format hashcat -outputfile hashes.txt

The attacker does not need to know the user’s password or have elevated privileges. The captured AS-REP hashes can then be used in offline password cracking attacks.

The final stage of AS-REP Roasting involves attempting to crack the captured AS-REP hashes offline using brute-force or dictionary attacks. Tools like Hashcat or John the Ripper support the relevant Kerberos encryption types (e.g., Kerberos 5 AS-REP etype 23).

hashcat -m 18200 hashes.txt wordlist.txt

If the user’s password is weak or reused, attackers can recover plaintext credentials, enabling further compromise of the environment. Offline cracking is particularly dangerous because it is undetectable by network monitoring tools.

For more on password cracking, see Password Cracking Guide 2025: 5 Latest Techniques.

Successful AS-REP Roasting attacks can have severe consequences:

• Credential Theft: Attackers gain access to user accounts, potentially including privileged or service accounts.
• Lateral Movement: Compromised credentials can be used to move laterally within the network, escalating privileges and accessing sensitive resources.
• Persistence: Attackers may create backdoors or maintain access using stolen credentials.
• Data Breaches: Exfiltration of sensitive data, intellectual property, or personal information.

According to CrowdStrike, Kerberos-based attacks, including AS-REP Roasting, are increasingly leveraged by advanced persistent threat (APT) groups due to their stealth and effectiveness.

AS-REP Roasting typically targets:

• Service Accounts: Accounts used by applications or services, often with elevated privileges and weak passwords.
• Legacy Accounts: Older accounts with pre-authentication disabled for compatibility reasons.
• Misconfigured User Accounts: Accounts where pre-authentication was disabled inadvertently or due to poor security practices.

Attackers prioritize accounts with high privileges or access to critical systems, as compromising these can yield significant control over the environment.

Detecting AS-REP Roasting requires monitoring for specific indicators, including:

• Unusual AS-REQ/AS-REP Traffic: High volumes of authentication requests for accounts with pre-authentication disabled.
• LDAP Enumeration: Suspicious queries for accounts with DONT_REQ_PREAUTH flag.
• Offline Cracking Activity: While offline cracking itself is undetectable, subsequent use of compromised credentials may trigger alerts.

Security teams should correlate authentication logs with user behavior analytics to identify anomalies. For guidance, see SANS Institute: Detecting Kerberos Attacks.

To effectively detect AS-REP Roasting:

• Enable Kerberos Authentication Logging: Configure domain controllers to log Kerberos authentication events (Event ID 4768 for AS-REQ, 4769 for TGS-REQ).
• Monitor for Pre-Authentication Failures: Track failed authentication attempts and requests for accounts with pre-authentication disabled.
• Centralize Logs: Use SIEM solutions to aggregate and analyze authentication logs for suspicious patterns.
• Alert on Enumeration Activity: Set alerts for LDAP queries targeting DoesNotRequirePreAuth accounts.

For more on logging, refer to CIS: Kerberos Logging and Monitoring.

The most effective defense against AS-REP Roasting is to enforce Kerberos pre-authentication for all accounts. This can be achieved by ensuring the DONT_REQ_PREAUTH flag is not set on any user or service account.

Administrators can audit and remediate accounts using PowerShell:

Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} | Set-ADUser -DoesNotRequirePreAuth $false

Regularly review account configurations and apply group policies to prevent the creation of accounts without pre-authentication. For more on hardening Kerberos, see CISA: Kerberos Pre-Authentication.

Even if an attacker obtains AS-REP hashes, strong password policies can significantly reduce the risk of successful offline cracking. Implement the following best practices:

• Enforce Complex Passwords: Require a mix of uppercase, lowercase, numbers, and special characters.
• Minimum Password Length: Set passwords to at least 14 characters.
• Regular Password Changes: Rotate passwords periodically, especially for privileged and service accounts.
• Monitor for Password Reuse: Prevent users from reusing previous passwords.

For password policy recommendations, see Password Policy Best Practices 2025.

Regularly audit user and service accounts to identify and remediate risky configurations:

• Review Account Permissions: Limit privileges to the minimum necessary for each account.
• Disable Unused Accounts: Remove or disable legacy and unused accounts.
• Implement Multi-Factor Authentication (MFA): Add an extra layer of security for sensitive accounts.
• Monitor Account Creation and Modification: Alert on changes to account properties, especially pre-authentication settings.

For more on account hardening, consult IAM Best Practices 2025: Control Access.

Several high-profile breaches have leveraged Kerberos ticket attacks, including AS-REP Roasting. For example, Mandiant has documented APT groups using AS-REP Roasting to compromise privileged accounts in targeted organizations. In these incidents, attackers exploited misconfigured service accounts to gain initial access and then moved laterally using cracked credentials.

In another case, a financial institution suffered a data breach when attackers identified legacy accounts with pre-authentication disabled. The attackers used AS-REP Roasting to obtain credentials, escalate privileges, and exfiltrate sensitive data.

Key takeaways from real-world incidents include:

• Configuration Drift: Regular configuration reviews are essential to prevent the reintroduction of vulnerabilities.
• Importance of Monitoring: Early detection of enumeration and authentication anomalies can prevent escalation.
• Defense in Depth: Relying on a single control is insufficient; combine pre-authentication, strong passwords, and monitoring for robust defense.

For more case studies, see LastPass Vault Leak 2023: Cloud Key Risks.

Attackers and penetration testers use several tools to automate AS-REP Roasting:

• Impacket GetNPUsers.py: Python tool for requesting AS-REP hashes from the KDC.
• Rubeus: Powerful C# tool for Kerberos abuse, including AS-REP Roasting functionality.
• Cracking Tools: Hashcat and John the Ripper support Kerberos AS-REP hash formats for offline password attacks.

For more on offensive tools, see Impacket and Rubeus.

Defenders can leverage the following tools and solutions:

• SIEM Platforms: Solutions like Splunk, Elastic SIEM, and Microsoft Sentinel can monitor and alert on suspicious Kerberos activity.
• Active Directory Auditing Tools: BloodHound and PingCastle help identify accounts with pre-authentication disabled.
• PowerShell Scripts: Custom scripts for auditing DoesNotRequirePreAuth accounts.

For a list of recommended defensive tools, see CrowdStrike: Kerberos Attacks.

Kerberos AS-REP Roasting remains a potent threat to organizations relying on Active Directory for authentication. By exploiting accounts without pre-authentication, attackers can obtain encrypted authentication responses and crack them offline to recover credentials. The best defenses include enforcing Kerberos pre-authentication, implementing strong password policies, and continuously auditing account configurations. Proactive monitoring and incident response are essential to detect and mitigate AS-REP Roasting attempts before they lead to significant compromise. By understanding the mechanics of this attack and applying layered security controls, organizations can significantly reduce their risk and strengthen their overall cybersecurity posture.

• MITRE ATT&CK: AS-REP Roasting
• CISA: Kerberos Pre-Authentication
• CrowdStrike: Kerberos Attacks
• Password Cracking Guide 2025: 5 Latest Techniques
• Password Policy Best Practices 2025
• IAM Best Practices 2025: Control Access
• LastPass Vault Leak 2023: Cloud Key Risks
• Impacket
• Rubeus
• Microsoft: UserAccountControl
• IETF RFC 4120: Kerberos Protocol
• MIT Kerberos Project