04 - S4U - TGS2_REP

Return

[TGS-REP] pvno: 5, msg-type: 13
crealm: TEST.LOCAL
cname: test1@test.local (10)
ticket:
[Ticket] tkt-vno: 5
realm: TEST.LOCAL
sname: cifs/dc-2016.test.local (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 14
[EncTicketPart]
flags: 0x40a50000 (name_canonicalize/enc_pa_rep, ok_as_delegate/cname_in_pa_data, pre_authent, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: 1a1d2751c6a4347724287274fb755f2f2591fe3aa363869d688254de885944c4
crealm: TEST.LOCAL
cname: test1@test.local (10)
transited: TODO
authtime: 2018/01/12 08:02:24.0
*starttime: 2018/01/12 08:02:24.0
endtime: 2018/01/12 08:17:24.0
*renew-till: 2018/01/19 08:02:24.0
*authorization-data:
[type: 1 - sise: 958] AD-IF-RELEVANT
[type: 128 - sise: 936] AD-WIN2K-PAC
[PACTYPE]
cBuffers: 6
Version: 0
Buffers:
[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 512, Offset: 0x85ca3b6248
[KERB_VALIDATION_INFO]
LogonTime: 2017/12/22 07:51:32.391
PasswordLastSet: 2016/10/19 06:39:20.972
PasswordCanChange: 2016/10/20 06:39:20.972
EffectiveName: test1
FullName: Test1
LogonCount: 6
BadPasswordCount: 0
UserId: 1103
PrimaryGroupId: 513
GroupIds (GroupCount: 2): 513 (0x7), 512 (0x7)
UserFlags: 544
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x210
FailedILogonCount: 0
ExtraSids (SidCount: 1):
S-1-18-2 (7)
ResourceGroupDomainSid: S-1-5-21-2322411092-424064500-325241940
ResourceGroupIds (ResourceGroupCount: 1): 572 (0x20000007)
[PAC_INFO_BUFFER 1] ulType: 0xb, cbBufferSize: 160, Offset: 0x85ca3b6448
[S4U_DELEGATION_INFO]
S4U2proxyTarget: cifs/dc-2016.test.local
TransitedListSize: 1
S4UTransitedServices[0]: srv-01$@TEST.LOCAL
[PAC_INFO_BUFFER 2] ulType: 0xa, cbBufferSize: 42, Offset: 0x85ca3b64e8
[PAC_CLIENT_INFO]
ClientId: 0x01d38b7b-0xadfaa800
Name: test1@test.local
[PAC_INFO_BUFFER 3] ulType: 0xc, cbBufferSize: 72, Offset: 0x85ca3b6518
[UPN_DNS_INFO]
Upn: test1@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x0
[PAC_INFO_BUFFER 4] ulType: 0x6, cbBufferSize: 16, Offset: 0x85ca3b6560
[PAC_SIGNATURE_DATA] Server Signature
SignatureType: 0x10
Signature: b7a95a64ab17c393651e130b
[PAC_INFO_BUFFER 5] ulType: 0x7, cbBufferSize: 20, Offset: 0x85ca3b6570
[PAC_SIGNATURE_DATA] KDC Signature
SignatureType: 0xffffff76
Signature: 3583a9a10ba54464afc0b2bdf5d60c0b
[type: 1 - sise: 95] AD-IF-RELEVANT
[type: 141 - sise: 53] KERB-AD-RESTRICTION-ENTRY
type: 0 - sise: 0
type: 0 - sise: 40
[type: 142 - sise: 16] KERB-LOCAL - TODO
enc-part: EncryptedData[EncTGSRepPart] etype: 0x12 (AES256_HMAC_SHA1_96)
[EncKDCRepPart]
key: [EncryptionKey] keytype: 0x12, keyvalue: 1a1d2751c6a4347724287274fb755f2f2591fe3aa363869d688254de885944c4
last-req: TODO
nonce 0x2fbe6c41
flags: 0x40a50000 (name_canonicalize/enc_pa_rep, ok_as_delegate/cname_in_pa_data, pre_authent, renewable, forwardable)
authtime: 2018/01/12 08:02:24.0
starttime: 2018/01/12 08:02:24.0
endtime: 2018/01/12 08:17:24.0
*renew-till: 2018/01/19 08:02:24.0
srealm: TEST.LOCAL
sname: cifs/dc-2016.test.local (2)
*encrypted-pa-data:
[PA-DATA]
[1] padata-type: 165 (PA-SUPPORTED-ENCTYPES), KerbSupportedEncryptionTypes: 0x2001f
[2] padata-type: 167 (PA-PAC-OPTIONS), KerberosFlags: 0x10000000 (0x10000000)