02 - Fast - AS_REQ

Return

[AS-REQ] pvno: 5, msg-type: 10
*padata:
[PA-DATA]
[1] padata-type: 136 (PA-FX-FAST)
[PA-FX-FAST-REQUEST]
armored-data:
[KrbFastArmoredReq]
*armor: EXPLICIT (field present)
[KrbFastArmor]
armor-type: 1 (FX_FAST_ARMOR_AP_REQUEST)
armor-value:
[AP-REQ] pvno: 5, msg-type: 14
ap-option: 0x0 ()
ticket:
[Ticket (TGT Computer)] tkt-vno: 5
realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2
[EncTicketPart]
flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: bc5e696cca6c60fbfb2e845a36d8a0d1680ddab90af2495ec9fab97da4e5c10c
crealm: TEST.LOCAL
cname: WIN10$ (1)
transited: TODO
authtime: 2017/05/26 16:52:16.0
*starttime: 2017/05/26 16:52:16.0
endtime: 2017/05/27 02:52:16.0
*renew-till: 2017/05/27 02:52:16.0
*authorization-data:
[type: 1 - sise: 1246] AD-IF-RELEVANT
[type: 128 - sise: 1224] AD-WIN2K-PAC
[PACTYPE]
cBuffers: 6
Version: 0
Buffers:
[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 496, Offset: 0xdd95a05b38
[KERB_VALIDATION_INFO]
LogonTime: 2017/05/26 14:57:41.209
PasswordLastSet: 2017/05/26 06:46:09.106
PasswordCanChange: 2017/05/27 06:46:09.106
EffectiveName: WIN10$
LogonCount: 413
BadPasswordCount: 0
UserId: 1111
PrimaryGroupId: 515
GroupIds (GroupCount: 2): 1120 (0x7), 515 (0x7)
UserFlags: 32
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x40080
FailedILogonCount: 0
ExtraSids (SidCount: 2):
S-1-5-21-0-0-0-497 (7)
S-1-18-1 (7)
ResourceGroupDomainSid: NULL
ResourceGroupIds (ResourceGroupCount: 0): NONE
[PAC_INFO_BUFFER 1] ulType: 0xa, cbBufferSize: 22, Offset: 0xdd95a05d28
[PAC_CLIENT_INFO]
ClientId: 0x01d2d640-0x6e10a000
Name: WIN10$
[PAC_INFO_BUFFER 2] ulType: 0xc, cbBufferSize: 80, Offset: 0xdd95a05d40
[UPN_DNS_INFO]
Upn: WIN10$@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x1
[PAC_INFO_BUFFER 3] ulType: 0xd, cbBufferSize: 480, Offset: 0xdd95a05d90
[PAC_CLIENT_CLAIMS_INFO] Version: 1, Count: 3
[0] Name: ad://ext/adminDescriptio:88d4a403bc439b70, Flags: 0x0, Type: 3, Count: 1
[0] Workstation AD
[1] Name: ad://ext/description:88d46537a8db15a9, Flags: 0x0, Type: 3, Count: 1
[0] adm
[2] Name: ad://ext/AuthenticationSilo, Flags: 0x0, Type: 3, Count: 1
[0] test
[PAC_INFO_BUFFER 4] ulType: 0x6, cbBufferSize: 16, Offset: 0xdd95a05f70
[PAC_SIGNATURE_DATA] Server Signature
SignatureType: 0x10
Signature: abf4de9ad421b4c97f30854c
[PAC_INFO_BUFFER 5] ulType: 0x7, cbBufferSize: 20, Offset: 0xdd95a05f80
[PAC_SIGNATURE_DATA] KDC Signature
SignatureType: 0xffffff76
Signature: 9de632d6cefebafcb09b3fe53082b04a
authenticator: EncryptedData[Authenticator] etype: 0x12 (AES256_HMAC_SHA1_96)
[Authenticator] authenticator-vno: 5
crealm: TEST.LOCAL
cname: WIN10$ (1)
ctime: 2017/05/26 16:57:55.0
*subkey: [EncryptionKey] keytype: 0x12, keyvalue: fe527d34ad592d83e9c450a2587f39505d91988a0e7d8ea5532f1f684a9bf26c
*seq-number: 00
req-checksum:
[Checksum]
cksumtype: 0x10
checksum(UNKNOWN): 71d8009747a1ec9895887cff
enc-fast-req: EncryptedData[KrbFastReq] etype: 0x12 (AES256_HMAC_SHA1_96)
[KrbFastReq]
fast-options: 0x0 ()
padata:
[PA-DATA]
[1] padata-type: 138 (PA-ENCRYPTED-CHALLENGE)
[PA-ENC-TS-ENC] etype: 0x12 (AES256_HMAC_SHA1_96)
patimestamp: 2017/05/26 16:57:55.0
*pausec: 722434
[2] padata-type: 128 (PA-PAC-REQUEST), padata-value: TODO
[3] padata-type: 167 (PA-PAC-OPTIONS), KerberosFlags: 0x80000000 (Claims)
req-body:
[KDC-REQ-BODY]
kdc-options: 0x40810010 (enc_pa_rep, name_canonicalize, renewable, forwardable, 0x10)
*cname: adm_ad (1)
realm: TEST.LOCAL
*sname: krbtgt/TEST.LOCAL (2)
till: 2037/09/13 02:48:05.0
*rtime: 2037/09/13 02:48:05.0
nonce: 0x39b387e7
etype:
etype: 0x12 (AES256_HMAC_SHA1_96)
*addresses:
addr-type: 20 (NetBios), address: WIN10
req-body:
[KDC-REQ-BODY]
kdc-options: 0x40810010 (enc_pa_rep, name_canonicalize, renewable, forwardable, 0x10)
*cname: adm_ad (1)
realm: TEST.LOCAL
*sname: krbtgt/TEST.LOCAL (2)
till: 2037/09/13 02:48:05.0
*rtime: 2037/09/13 02:48:05.0
nonce: 0x39b387e7
etype:
etype: 0x12 (AES256_HMAC_SHA1_96)
*addresses:
addr-type: 20 (NetBios), address: WIN10

Calcul of Armor Key:
| key1: [EncryptionKey] keytype: 0x12, keyvalue: fe527d34ad592d83e9c450a2587f39505d91988a0e7d8ea5532f1f684a9bf26c (Authenticator.subkey)
| key2: [EncryptionKey] keytype: 0x12, keyvalue: bc5e696cca6c60fbfb2e845a36d8a0d1680ddab90af2495ec9fab97da4e5c10c (TGT_Computer.EncTicketPart.key)
| salt1: subkeyarmor
| salt2: ticketarmor
| Armor key: [EncryptionKey] keytype: 0x12, keyvalue: b779c88c9abf7a8deb1e68648169fea67d62dd3c3622d84f37b66391ed42b312

KrbFastArmoredReq.enc-fast-req is encrypted with Armor Key.

KrbFastArmoredReq.enc-fast-req is encrypted with Armor Key.

[?] ticket.enc-part decrypted with [EncryptionKey] keytype: 0x12, keyvalue: 7f492b5b6d460f19256e9397d42c030f4485fe6eaffd69b9c0fbc98aaafdbf20
[?] Request->authenticator decrypted with [EncryptionKey] keytype: 0x12, keyvalue: bc5e696cca6c60fbfb2e845a36d8a0d1680ddab90af2495ec9fab97da4e5c10c

Calcul of Challenge Key:
| key1: [EncryptionKey] keytype: 0x12, keyvalue: b779c88c9abf7a8deb1e68648169fea67d62dd3c3622d84f37b66391ed42b312
| key2: [EncryptionKey] keytype: 0x12, keyvalue: 95da09a0556fa2fd677f6338fc3b80a432a1b24b24f364d1aa7efa4973a4f15d
| salt1: clientchallengearmor
| salt2: challengelongterm
| Challenge key: [EncryptionKey] keytype: 0x12, keyvalue: fa03788c4c00e0d8543d89d7d70d0678ea04882a500ff0e3ba02128a39d2cc1c