> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/internal-pentest/timeroast.md).

# TimeRoast

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

In AD environments, the DC hashes NTP responses with the computer account NT hash. That means that you can request and brute force all computer accounts in a domain from an **UNAUTHENTICATED** perspective!

{% embed url="<https://www.secura.com/uploads/whitepapers/Secura-WP-Timeroasting-v3.pdf>" %}

{% embed url="<https://snovvcrash.rocks/2024/12/08/applicability-of-the-timeroasting-attack.html>" %}

## Timeroast

{% embed url="<https://github.com/SecuraBV/Timeroast>" %}

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F7tpay81lM4aJ7em48t3C%2Fimage.png?alt=media&amp;token=6e759227-3ef1-46c5-b962-3772bc9ed8c3" alt=""><figcaption></figcaption></figure>

## NXC

```
nxc smb IP -M timeroast
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F6vVrXpPy9xg5LYIlw9EE%2FGducWUsXIAA2GNZ.jpg?alt=media&amp;token=2eb50dc8-a981-4526-b06a-aaba0f941689" alt=""><figcaption></figcaption></figure>

## Cracking

Use `extra-scripts/timecrack.py` from SecuraBV `Timeroast` tool

Or: Hashcat [will add support for Timeroast hashes](https://github.com/hashcat/hashcat/issues/3629) as hash type **31300**. Currently, it's already available in the [beta release](https://hashcat.net/beta/).

## TargetedTimeroast

{% embed url="<https://github.com/OffsecDeer/TargetedTimeroast>" %}

{% embed url="<https://medium.com/@offsecdeer/targeted-timeroasting-stealing-user-hashes-with-ntp-b75c1f71b9ac>" %}