01 - Simple - TGS

*padata:

[PA-DATA]

[1] padata-type: 1 (PA-TGS-REQ), padata-value:

[AP-REQ] pvno: 5, msg-type: 14

ap-option: 0x0 ()
ticket:

[Ticket] tkt-vno: 5

realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2

[EncTicketPart]

flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: 90bab82260ad046c8d3c2fd7bb9f24171dfb1e682f4e5282075e6d3c1e5f528c
crealm: TEST.LOCAL
cname: adm_ad (1)
transited: TODO
authtime: 2017/05/23 08:05:12.0
*starttime: 2017/05/23 08:05:12.0
endtime: 2017/05/23 18:05:12.0
*renew-till: 2017/05/30 08:05:12.0
*authorization-data:

[type: 1 - sise: 726] AD-IF-RELEVANT

[type: 128 - sise: 704] AD-WIN2K-PAC

[PACTYPE]

cBuffers: 5
Version: 0
Buffers:

[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 472, Offset: 0xf09ad25c08

[KERB_VALIDATION_INFO]

LogonTime: 2017/05/23 08:04:43.509
PasswordLastSet: 2017/05/23 08:03:18.266
PasswordCanChange: 2017/05/24 08:03:18.266
EffectiveName: adm_ad
FullName: adm_ad
LogonCount: 2
BadPasswordCount: 0
UserId: 1119
PrimaryGroupId: 513
GroupIds (GroupCount: 2): 513 (0x7), 512 (0x7)
UserFlags: 32
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x210
FailedILogonCount: 0
ExtraSids (SidCount: 1):

S-1-18-1 (7)

[PAC_INFO_BUFFER 1] ulType: 0xa, cbBufferSize: 22, Offset: 0xf09ad25de0

[PAC_CLIENT_INFO]

ClientId: 0x01d2d39b-0x4d73ec00
Name: adm_ad

[PAC_INFO_BUFFER 2] ulType: 0xc, cbBufferSize: 80, Offset: 0xf09ad25df8

[UPN_DNS_INFO]

Upn: adm_ad@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x0

[PAC_INFO_BUFFER 3] ulType: 0x6, cbBufferSize: 16, Offset: 0xf09ad25e48

[PAC_SIGNATURE_DATA] Server Signature

SignatureType: 0x10
Signature: ccdd15770b53d4dcbd423b6b

[PAC_INFO_BUFFER 4] ulType: 0x7, cbBufferSize: 20, Offset: 0xf09ad25e58

[PAC_SIGNATURE_DATA] KDC Signature

SignatureType: 0xffffff76
Signature: 86be15adc4b7ec94b0712334a143992b

authenticator: EncryptedData[Authenticator] etype: 0x12 (AES256_HMAC_SHA1_96)

[Authenticator] authenticator-vno: 5

crealm: TEST.LOCAL
cname: adm_ad (1)
*cksum:

[Checksum]

cksumtype: 0x7
checksum(UNKNOWN): 6b4c4a5aabb55ec3d569c371ad145631

ctime: 2017/05/23 08:05:12.0
*seq-number: 4caa0344

[2] padata-type: 167 (PA-PAC-OPTIONS), KerberosFlags: 0x40000000 (Branch Aware)

req-body:

[KDC-REQ-BODY]

kdc-options: 0x40810000 (enc_pa_rep, name_canonicalize, renewable, forwardable)
realm: TEST.LOCAL
*sname: cifs/srv-01.test.local (2)
till: 2037/09/13 02:48:05.0
nonce: 0x4caa0344
etype:

etype: 0x12 (AES256_HMAC_SHA1_96)
etype: 0x11 (AES128_HMAC_SHA1_96)

*enc-authorization-data: EncryptedData[AuthorizationData] etype: 0x12 (AES256_HMAC_SHA1_96)

[type: 1 - sise: 95] AD-IF-RELEVANT

[type: 141 - sise: 53] KERB-AD-RESTRICTION-ENTRY
type: 0 - sise: 0
type: 0 - sise: 40
[type: 142 - sise: 16] KERB-LOCAL - TODO

01 - Simple - TGS_REQ