AS-REP Roasting

Find the account with Kerberos pre-authentication disabled, then turn that misconfiguration into a credential.

Enumerate simulated LDAP for DONT_REQ_PREAUTH, request the AS-REP material, crack it with the local wordlist, and use the recovered password against the mailbox endpoint.

Variants include tempting service-looking accounts and disabled decoys so the preauth flag remains the deciding evidence.

What you'll practice