> For the complete documentation index, see [llms.txt](https://www.udayxd.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.udayxd.tech/notes/kerberos/timeroasting.md). # Timeroasting ## Timeroasting The Attack That Asks Nicely and Gets Your Hashes Anyway I want to tell you about an attack that still kind of blows my mind every time I think about it. No credentials. No foothold. You just show up on the network, ask the Domain Controller a question it was never supposed to answer, and walk away with password hashes for every computer account in the domain. It is called Timeroasting. And it works because of NTP. *** ### Wait, NTP? The Clock Sync Protocol? Yeah. Bear with me. Windows machines sync their clocks with the Domain Controller over NTP. Pretty standard stuff. The problem with vanilla NTP is that it has no authentication a man-in-the-middle attacker could spoof the response and mess with the client's clock. Microsoft knew this, so they added a custom extension where the DC signs its NTP response using a MAC derived from the requesting computer's password hash. The formula looks like this: ``` MAC = MD5( MD4(password) || NTP-response ) ``` The idea being only the real DC knows the computer's password hash, so only the real DC can produce a valid signature. The client checks it, clock is synced, everyone is happy. Except nobody thought about what happens when the *requester* is not who they claim to be. *** ### The Part Where It Falls Apart When a computer sends an NTP request, it includes its RID basically just a number that identifies its account in the domain. The DC looks up that RID, grabs the corresponding password hash, and signs the response. Here is the thing though. **The DC never checks if you are actually that computer.** You can send an NTP request with literally any RID you want. The DC will look it up and sign the response anyway. No authentication on your end. No questions asked. It just... does it. So an attacker sitting outside the domain with zero credentials can loop through every possible RID, send a request for each one, and collect a signed response for all of them. What they end up with is a salted password hash for every single computer account in the domain. For free. Over a protocol that nobody monitors. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://www.udayxd.tech/notes/kerberos/timeroasting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.