02 - Fast - AS

*padata:

[PA-DATA]

[1] padata-type: 136 (PA-FX-FAST)

[PA-FX-FAST-REPLY]

armored-data:

[KrbFastArmoredRep]

enc-fast-rep: EncryptedData[KrbFastResponse] etype: 0x12 (AES256_HMAC_SHA1_96)

[KrbFastResponse]

padata:

[PA-DATA]

[1] padata-type: 19 (PA-ETYPE-INFO2)

[ETYPE-INFO2-ENTRY]

[1] etype: 0
[2] etype: 18, salt: TEST.LOCALadm_ad

[2] padata-type: 138 (PA-ENCRYPTED-CHALLENGE)

[PA-ENC-TS-ENC] etype: 0x12 (AES256_HMAC_SHA1_96)

patimestamp: 2017/05/26 16:57:55.0
*pausec: 716016

*strengthen-key: [EncryptionKey] keytype: 0x12, keyvalue: ae9ea3b66d62359c393e8daab5609f9fb7fd51c9ac4e831bb2ba1b9f3c68b65f
*finished:

[KrbFastFinished]

timestamp: 2017/05/26 16:57:55.0
usec: 0xaecf0
crealm: TEST.LOCAL
cname: adm_ad (1)
ticket-checksum:

[Checksum]

cksumtype: 0x10
checksum(UNKNOWN): 8ebf2f184dd89473eea97307

nonce: 0x39b387e7

crealm: TEST.LOCAL
cname: adm_ad (1)
ticket:

[Ticket] tkt-vno: 5

realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2

[EncTicketPart]

flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: 0ef00ee9b2d63d944c47da97b3a49b3a60b9ed25b034601cb3abe1e7be75493f
crealm: TEST.LOCAL
cname: adm_ad (1)
transited: TODO
authtime: 2017/05/26 16:57:55.0
*starttime: 2017/05/26 16:57:55.0
endtime: 2017/05/27 02:57:55.0
*renew-till: 2017/06/02 16:57:55.0
*authorization-data:

[type: 1 - sise: 1054] AD-IF-RELEVANT

[type: 128 - sise: 1032] AD-WIN2K-PAC

[PACTYPE]

cBuffers: 6
Version: 0
Buffers:

[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 512, Offset: 0xd0ca755168

[KERB_VALIDATION_INFO]

LogonTime: 2017/05/26 16:57:11.799
PasswordLastSet: 2017/05/23 08:03:18.266
PasswordCanChange: 2017/05/24 08:03:18.266
EffectiveName: adm_ad
FullName: adm_ad
LogonCount: 11
BadPasswordCount: 0
UserId: 1119
PrimaryGroupId: 513
GroupIds (GroupCount: 2): 513 (0x7), 512 (0x7)
UserFlags: 32
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x210
FailedILogonCount: 0
ExtraSids (SidCount: 2):

S-1-5-21-0-0-0-497 (7)
S-1-18-1 (7)

ResourceGroupDomainSid: NULL
ResourceGroupIds (ResourceGroupCount: 0): NONE

[PAC_INFO_BUFFER 1] ulType: 0xa, cbBufferSize: 22, Offset: 0xd0ca755368

[PAC_CLIENT_INFO]

ClientId: 0x01d2d641-0x381feb80
Name: adm_ad

[PAC_INFO_BUFFER 2] ulType: 0xc, cbBufferSize: 80, Offset: 0xd0ca755380

[UPN_DNS_INFO]

Upn: adm_ad@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x0

[PAC_INFO_BUFFER 3] ulType: 0xd, cbBufferSize: 272, Offset: 0xd0ca7553d0

[PAC_CLIENT_CLAIMS_INFO] Version: 1, Count: 1

[0] Name: ad://ext/adminDescriptio:88d4a403bc439b70, Flags: 0x0, Type: 3, Count: 1

[0] AD_Level

[PAC_INFO_BUFFER 4] ulType: 0x6, cbBufferSize: 16, Offset: 0xd0ca7554e0

[PAC_SIGNATURE_DATA] Server Signature

SignatureType: 0x10
Signature: 9fa3064cbe0a629d15e8f3a7

[PAC_INFO_BUFFER 5] ulType: 0x7, cbBufferSize: 20, Offset: 0xd0ca7554f0

[PAC_SIGNATURE_DATA] KDC Signature

SignatureType: 0xffffff76
Signature: 0245d8ed69360a41abb7d9498fd23b4b

enc-part: EncryptedData[EncASRepPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 4

[EncKDCRepPart]

key: [EncryptionKey] keytype: 0x12, keyvalue: 0ef00ee9b2d63d944c47da97b3a49b3a60b9ed25b034601cb3abe1e7be75493f
last-req: TODO
nonce 0x39b387e7
*key-expiration: 2037/09/14 02:48:05.0
flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
authtime: 2017/05/26 16:57:55.0
starttime: 2017/05/26 16:57:55.0
endtime: 2017/05/27 02:57:55.0
*renew-till: 2017/06/02 16:57:55.0
srealm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
*caddr:

addr-type: 20 (NetBios), address: WIN10

*encrypted-pa-data:

[PA-DATA]

[1] padata-type: 167 (PA-PAC-OPTIONS), KerberosFlags: 0x80000000 (Claims)
[2] padata-type: 165 (PA-SUPPORTED-ENCTYPES), KerbSupportedEncryptionTypes: 0x5001f

02 - Fast - AS_REP