03 - Compound - TGS2

*padata:

[PA-DATA]

[1] padata-type: 1 (PA-TGS-REQ), padata-value:

[AP-REQ] pvno: 5, msg-type: 14

ap-option: 0x0 ()
ticket:

[Ticket] tkt-vno: 5

realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2

[EncTicketPart]

flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: 1bcbbb69bd49e69bfac5e22ddb5f381fb7ae893993b1b4389e06e4f96456cfb1
crealm: TEST.LOCAL
cname: adm_ad (1)
transited: TODO
authtime: 2017/05/29 16:57:55.0
*starttime: 2017/05/29 16:57:55.0
endtime: 2017/05/30 02:57:55.0
*renew-till: 2017/06/05 16:57:55.0
*authorization-data:

[type: 1 - sise: 1054] AD-IF-RELEVANT

[type: 128 - sise: 1032] AD-WIN2K-PAC

[PACTYPE]

cBuffers: 6
Version: 0
Buffers:

[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 512, Offset: 0x52c5b40618

[KERB_VALIDATION_INFO]

LogonTime: 2017/05/29 14:38:10.364
PasswordLastSet: 2017/05/23 08:03:18.266
PasswordCanChange: 2017/05/24 08:03:18.266
EffectiveName: adm_ad
FullName: adm_ad
LogonCount: 23
BadPasswordCount: 0
UserId: 1119
PrimaryGroupId: 513
GroupIds (GroupCount: 2): 513 (0x7), 512 (0x7)
UserFlags: 32
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x210
FailedILogonCount: 0
ExtraSids (SidCount: 2):

S-1-5-21-0-0-0-497 (7)
S-1-18-1 (7)

ResourceGroupDomainSid: NULL
ResourceGroupIds (ResourceGroupCount: 0): NONE

[PAC_INFO_BUFFER 1] ulType: 0xa, cbBufferSize: 22, Offset: 0x52c5b40818

[PAC_CLIENT_INFO]

ClientId: 0x01d2d89c-0xb75d2b80
Name: adm_ad

[PAC_INFO_BUFFER 2] ulType: 0xc, cbBufferSize: 80, Offset: 0x52c5b40830

[UPN_DNS_INFO]

Upn: adm_ad@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x0

[PAC_INFO_BUFFER 3] ulType: 0xd, cbBufferSize: 272, Offset: 0x52c5b40880

[PAC_CLIENT_CLAIMS_INFO] Version: 1, Count: 1

[0] Name: ad://ext/adminDescriptio:88d4a403bc439b70, Flags: 0x0, Type: 3, Count: 1

[0] AD_Level

[PAC_INFO_BUFFER 4] ulType: 0x6, cbBufferSize: 16, Offset: 0x52c5b40990

[PAC_SIGNATURE_DATA] Server Signature

SignatureType: 0x10
Signature: 7a5c672b49c75d0885f4c01d

[PAC_INFO_BUFFER 5] ulType: 0x7, cbBufferSize: 20, Offset: 0x52c5b409a0

[PAC_SIGNATURE_DATA] KDC Signature

SignatureType: 0xffffff76
Signature: 6c234f02a62a94c3e9804ad1b93e39a6

authenticator: EncryptedData[Authenticator] etype: 0x12 (AES256_HMAC_SHA1_96)

[Authenticator] authenticator-vno: 5

crealm: TEST.LOCAL
cname: adm_ad (1)
*cksum:

[Checksum]

cksumtype: 0x7
checksum(UNKNOWN): e4ef5389498d29def78cd16fbf271345

ctime: 2017/05/29 16:57:54.0
*subkey: [EncryptionKey] keytype: 0x12, keyvalue: 9273ea01c68c4f6d9fbb7caaf503ff515655bf3248be0ce2d1fcc8fc99d370c3
*seq-number: 3777d9a1

[2] padata-type: 136 (PA-FX-FAST)

[PA-FX-FAST-REQUEST]

armored-data:

[KrbFastArmoredReq]

*armor: EXPLICIT (field present)

[KrbFastArmor]

armor-type: 1 (FX_FAST_ARMOR_AP_REQUEST)
armor-value:

[AP-REQ] pvno: 5, msg-type: 14

ap-option: 0x0 ()
ticket:

[Ticket] tkt-vno: 5

realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2

[EncTicketPart]

flags: 0x40e10000 (enc_pa_rep, name_canonicalize, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: e05bec1f2efd46078c667187a4bd2fc62b693e1796d0597aa7ad0794b3e661bd
crealm: TEST.LOCAL
cname: WIN10$ (1)
transited: TODO
authtime: 2017/05/29 16:57:04.0
*starttime: 2017/05/29 16:57:04.0
endtime: 2017/05/30 02:57:04.0
*renew-till: 2017/05/30 02:57:04.0
*authorization-data:

[type: 1 - sise: 1166] AD-IF-RELEVANT

[type: 128 - sise: 1144] AD-WIN2K-PAC

[PACTYPE]

cBuffers: 6
Version: 0
Buffers:

[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 496, Offset: 0x52c5b47368

[KERB_VALIDATION_INFO]

LogonTime: 2017/05/29 15:11:39.454
PasswordLastSet: 2017/05/29 06:52:15.424
PasswordCanChange: 2017/05/30 06:52:15.424
EffectiveName: WIN10$
LogonCount: 433
BadPasswordCount: 0
UserId: 1111
PrimaryGroupId: 515
GroupIds (GroupCount: 2): 1120 (0x7), 515 (0x7)
UserFlags: 32
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x40080
FailedILogonCount: 0
ExtraSids (SidCount: 2):

S-1-5-21-0-0-0-497 (7)
S-1-18-1 (7)

ResourceGroupDomainSid: NULL
ResourceGroupIds (ResourceGroupCount: 0): NONE

[PAC_INFO_BUFFER 1] ulType: 0xa, cbBufferSize: 22, Offset: 0x52c5b47558

[PAC_CLIENT_INFO]

ClientId: 0x01d2d89c-0x98f73000
Name: WIN10$

[PAC_INFO_BUFFER 2] ulType: 0xc, cbBufferSize: 80, Offset: 0x52c5b47570

[UPN_DNS_INFO]

Upn: WIN10$@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x1

[PAC_INFO_BUFFER 3] ulType: 0xd, cbBufferSize: 400, Offset: 0x52c5b475c0

[PAC_CLIENT_CLAIMS_INFO] Version: 1, Count: 2

[0] Name: ad://ext/adminDescriptio:88d4a403bc439b70, Flags: 0x0, Type: 3, Count: 1

[0] Workstation AD

[1] Name: ad://ext/AuthenticationSilo, Flags: 0x0, Type: 3, Count: 1

[0] test

[PAC_INFO_BUFFER 4] ulType: 0x6, cbBufferSize: 16, Offset: 0x52c5b47750

[PAC_SIGNATURE_DATA] Server Signature

SignatureType: 0x10
Signature: b899a0176341a1cd332117a4

[PAC_INFO_BUFFER 5] ulType: 0x7, cbBufferSize: 20, Offset: 0x52c5b47760

[PAC_SIGNATURE_DATA] KDC Signature

SignatureType: 0xffffff76
Signature: 47c889542546b1fcdf8321ece23682ba

authenticator: EncryptedData[Authenticator] etype: 0x12 (AES256_HMAC_SHA1_96)

[Authenticator] authenticator-vno: 5

crealm: TEST.LOCAL
cname: WIN10$ (1)
ctime: 2017/05/29 16:57:54.0
*subkey: [EncryptionKey] keytype: 0x12, keyvalue: 8a5c70f5cebf242addfeb7ffaf8c1fed5c163c8c097b8ba21651ef7134b5f00c
*seq-number: 3777d9a1

req-checksum:

[Checksum]

cksumtype: 0x10
checksum(UNKNOWN): a67b261778fb4e14f6cb293e

enc-fast-req: EncryptedData[KrbFastReq] etype: 0x12 (AES256_HMAC_SHA1_96)

[KrbFastReq]

fast-options: 0x0 ()
padata:

[PA-DATA]

[1] padata-type: 167 (PA-PAC-OPTIONS), KerberosFlags: 0xc0000000 (Claims, Branch Aware)

req-body:

[KDC-REQ-BODY]

kdc-options: 0x40810000 (enc_pa_rep, name_canonicalize, renewable, forwardable)
realm: TEST.LOCAL
*sname: cifs/srv-01.test.local (2)
till: 2037/09/13 02:48:05.0
nonce: 0x3777d9a1
etype:

etype: 0x12 (AES256_HMAC_SHA1_96)
etype: 0x11 (AES128_HMAC_SHA1_96)

*enc-authorization-data: EncryptedData[AuthorizationData] etype: 0x12 (AES256_HMAC_SHA1_96)

[type: 1 - sise: 95] AD-IF-RELEVANT

[type: 141 - sise: 53] KERB-AD-RESTRICTION-ENTRY

type: 0 - sise: 0
type: 0 - sise: 40

[type: 142 - sise: 16] KERB-LOCAL - TODO