04 - S4U - AS

*padata:

[PA-DATA]

[1] padata-type: 19 (PA-ETYPE-INFO2)

[ETYPE-INFO2-ENTRY]

[1] etype: 0
[2] etype: 18, salt: TEST.LOCALhostsrv-01.test.local

crealm: TEST.LOCAL
cname: SRV-01$ (1)
ticket:

[Ticket] tkt-vno: 5

realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2

[EncTicketPart]

flags: 0x40e10000 (name_canonicalize/enc_pa_rep, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: 2ffa7b09673f7fd9e9b31a25e0f5a1caefa07379da4ed05fa6fc8ca0b080c1db
crealm: TEST.LOCAL
cname: SRV-01$ (1)
transited: TODO
authtime: 2018/01/12 08:02:24.0
*starttime: 2018/01/12 08:02:24.0
endtime: 2018/01/12 18:02:24.0
*renew-till: 2018/01/19 08:02:24.0
*authorization-data:

[type: 1 - sise: 710] AD-IF-RELEVANT

[type: 128 - sise: 688] AD-WIN2K-PAC

[PACTYPE]

cBuffers: 5
Version: 0
Buffers:

[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 456, Offset: 0x746bc70d58

[KERB_VALIDATION_INFO]

LogonTime: 2018/01/12 07:54:08.828
PasswordLastSet: 2017/05/29 07:11:59.566
PasswordCanChange: 2017/05/30 07:11:59.566
EffectiveName: SRV-01$
LogonCount: 585
BadPasswordCount: 0
UserId: 1106
PrimaryGroupId: 515
GroupIds (GroupCount: 1): 515 (0x7)
UserFlags: 32
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x40080
FailedILogonCount: 0
ExtraSids (SidCount: 1):

S-1-18-1 (7)

ResourceGroupDomainSid: NULL
ResourceGroupIds (ResourceGroupCount: 0): NONE

[PAC_INFO_BUFFER 1] ulType: 0xa, cbBufferSize: 24, Offset: 0x746bc70f20

[PAC_CLIENT_INFO]

ClientId: 0x01d38b7b-0xadfaa800
Name: SRV-01$

[PAC_INFO_BUFFER 2] ulType: 0xc, cbBufferSize: 80, Offset: 0x746bc70f38

[UPN_DNS_INFO]

Upn: SRV-01$@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x1

[PAC_INFO_BUFFER 3] ulType: 0x6, cbBufferSize: 16, Offset: 0x746bc70f88

[PAC_SIGNATURE_DATA] Server Signature

SignatureType: 0x10
Signature: 24d2852f999b460cad2f22d3

[PAC_INFO_BUFFER 4] ulType: 0x7, cbBufferSize: 20, Offset: 0x746bc70f98

[PAC_SIGNATURE_DATA] KDC Signature

SignatureType: 0xffffff76
Signature: fda7948dda22adf2069394da431fa472

enc-part: EncryptedData[EncASRepPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 10

[EncKDCRepPart]

key: [EncryptionKey] keytype: 0x12, keyvalue: 2ffa7b09673f7fd9e9b31a25e0f5a1caefa07379da4ed05fa6fc8ca0b080c1db
last-req: TODO
nonce 0x2ffc5ac7
*key-expiration: 2037/09/14 02:48:05.0
flags: 0x40e10000 (name_canonicalize/enc_pa_rep, pre_authent, initial, renewable, forwardable)
authtime: 2018/01/12 08:02:24.0
starttime: 2018/01/12 08:02:24.0
endtime: 2018/01/12 18:02:24.0
*renew-till: 2018/01/19 08:02:24.0
srealm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
*caddr:

addr-type: 20 (NetBios), address: SRV-01

*encrypted-pa-data:

[PA-DATA]

[1] padata-type: 165 (PA-SUPPORTED-ENCTYPES), KerbSupportedEncryptionTypes: 0x5001f

04 - S4U - AS_REP