Timeroasting abuses the authenticated NTP (network time) mechanism in Windows: an unauthenticated attacker sends an NTP request referencing a computer account's RID, and the domain controller replies with a message authentication code derived from that account's password hash. The attacker cracks it offline, like Kerberoasting but for machine accounts and with no credentials required. Machine passwords are usually long and random, so the practical risk is highest for legacy or manually-set computer accounts. Defend by ensuring strong machine passwords and monitoring.
What timeroasting is
Windows supports an authenticated variant of NTP where the time response is signed with a key derived from a computer account's password. Timeroasting sends crafted NTP requests that reference an account by its RID and collects the signed responses, which contain material tied to the machine account's password hash. Crucially, no authentication to the domain is required to ask for time.
How the attack works
The attacker queries the DC's NTP service for many RIDs with a tool such as timeroast.py <dc-ip>, collecting one crackable hash per computer account. They then run the hashes through an offline cracker. Machine accounts normally use 120-character random passwords that resist cracking, so the win is on accounts with weak or manually-set passwords (legacy devices, appliances, misconfigured joins). Shown for defensive testing.
How to defend against it
Ensure computer accounts use strong, automatically-rotated passwords, and hunt for machine accounts with weak or non-default passwords (legacy systems, appliances) that timeroasting could crack. Restrict and monitor NTP where feasible, and treat any crackable machine account as a finding to remediate, since a cracked machine account can enable further attacks.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]MITRE ATT&CK: Steal or Forge Kerberos Tickets(MITRE ATT&CK)
An unauthenticated attacker can quietly harvest crackable material from your NTP service. Talk to a security expert about auditing your machine accounts.