01 - Simple - AS

*padata:

[PA-DATA]

[1] padata-type: 19 (UNKNOWN)

crealm: TEST.LOCAL
cname: adm_ad (1)
ticket:

[Ticket] tkt-vno: 5

realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2

[EncTicketPart]

flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: 90bab82260ad046c8d3c2fd7bb9f24171dfb1e682f4e5282075e6d3c1e5f528c
crealm: TEST.LOCAL
cname: adm_ad (1)
transited: TODO
authtime: 2017/05/23 08:05:12.0
*starttime: 2017/05/23 08:05:12.0
endtime: 2017/05/23 18:05:12.0
*renew-till: 2017/05/30 08:05:12.0
*authorization-data:

[type: 1 - sise: 726] AD-IF-RELEVANT

[type: 128 - sise: 704] AD-WIN2K-PAC

[PACTYPE]

cBuffers: 5
Version: 0
Buffers:

[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 472, Offset: 0xdea29c08d8

[KERB_VALIDATION_INFO]

LogonTime: 2017/05/23 08:04:43.509
PasswordLastSet: 2017/05/23 08:03:18.266
PasswordCanChange: 2017/05/24 08:03:18.266
EffectiveName: adm_ad
FullName: adm_ad
LogonCount: 2
BadPasswordCount: 0
UserId: 1119
PrimaryGroupId: 513
GroupIds (GroupCount: 2): 513 (0x7), 512 (0x7)
UserFlags: 32
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x210
FailedILogonCount: 0
ExtraSids (SidCount: 1):

S-1-18-1 (7)

[PAC_INFO_BUFFER 1] ulType: 0xa, cbBufferSize: 22, Offset: 0xdea29c0ab0

[PAC_CLIENT_INFO]

ClientId: 0x01d2d39b-0x4d73ec00
Name: adm_ad

[PAC_INFO_BUFFER 2] ulType: 0xc, cbBufferSize: 80, Offset: 0xdea29c0ac8

[UPN_DNS_INFO]

Upn: adm_ad@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x0

[PAC_INFO_BUFFER 3] ulType: 0x6, cbBufferSize: 16, Offset: 0xdea29c0b18

[PAC_SIGNATURE_DATA] Server Signature

SignatureType: 0x10
Signature: ccdd15770b53d4dcbd423b6b

[PAC_INFO_BUFFER 4] ulType: 0x7, cbBufferSize: 20, Offset: 0xdea29c0b28

[PAC_SIGNATURE_DATA] KDC Signature

SignatureType: 0xffffff76
Signature: 86be15adc4b7ec94b0712334a143992b

enc-part: EncryptedData[EncASRepPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 4

[EncKDCRepPart]

key: [EncryptionKey] keytype: 0x12, keyvalue: 90bab82260ad046c8d3c2fd7bb9f24171dfb1e682f4e5282075e6d3c1e5f528c
last-req: TODO
nonce 0x4caa0341
*key-expiration: 2037/09/14 02:48:05.0
flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
authtime: 2017/05/23 08:05:12.0
starttime: 2017/05/23 08:05:12.0
endtime: 2017/05/23 18:05:12.0
*renew-till: 2017/05/30 08:05:12.0
srealm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
*caddr:

addr-type: 20 (NetBios), address: WIN10

01 - Simple - AS_REP