AS-REP Roasting exploits accounts for which Kerberos preauthentication is disabled. In a typical Kerberos authentication process, the client must send a timestamp encrypted with its password-derived key. This serves as proof that the authentication request is not being replayed.
However, if preauthentication is disabled, the client does not need to send this encrypted timestamp. As a result, an attacker can request a Ticket Granting Ticket (TGT) for the target user and receive an AS-REP message encrypted with the user’s password hash.
AS-REP Process
1) AS-REQ (Client -> KDC/AS)
- Timestamp 🔑 Encrypted with Client key (only if preauthentication is enabled)
2) AS-REP (KDC/AS -> Client)
- TGT 🔑 Encrypted with KDC key
- TGS Session Key 🔑 Encrypted with Client key
In this case we can jump the first step because the preauth is disabled. Once an attacker captures the AS-REP, they can attempt to crack the user's password offline.
