05 - PKINIT (RSA)

*padata:

[PA-DATA]

[1] padata-type: 15 (PA-PK-AS-REP_OLD), padata-value:

[PA-PK-AS-REP] choise: 2 (encKeyPack)

encKeyPack:

[ReplyKeyPack]

replyKey: [EncryptionKey] keytype: 0x12, keyvalue: 6290730bbe709bdc580ace9c1a954aaffd1bf982fca90526103353aba7a46a11
asChecksum:

[Checksum]

cksumtype: 0xe
checksum(UNKNOWN): 75296527530c7c0387e073d2367ee740588a22a2

crealm: TEST.LOCAL
cname: admin (1)
ticket:

[Ticket] tkt-vno: 5

realm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
enc-part: EncryptedData[EncTicketPart] etype: 0x12 (AES256_HMAC_SHA1_96), kvno: 2

[EncTicketPart]

flags: 0x40e10000 (name_canonicalize/enc_pa_rep, pre_authent, initial, renewable, forwardable)
key: [EncryptionKey] keytype: 0x12, keyvalue: a045b25d5a25841d09c19c6c7ad71500727d94d92ba1c28361815aa78f3c68f2
crealm: TEST.LOCAL
cname: admin (1)
transited: TODO
authtime: 2018/05/10 13:10:25.0
*starttime: 2018/05/10 13:10:25.0
endtime: 2018/05/10 23:10:25.0
*renew-till: 2018/05/17 13:10:25.0
*authorization-data:

[type: 1 - sise: 886] AD-IF-RELEVANT

[type: 128 - sise: 864] AD-WIN2K-PAC

[PACTYPE]

cBuffers: 6
Version: 0
Buffers:

[PAC_INFO_BUFFER 0] ulType: 0x1, cbBufferSize: 472, Offset: 0xac4c42e048

[KERB_VALIDATION_INFO]

LogonTime: 2018/05/10 13:10:00.996
PasswordLastSet: 2018/01/04 10:17:04.602
PasswordCanChange: 2018/01/05 10:17:04.602
EffectiveName: admin
FullName: admin
LogonCount: 423
BadPasswordCount: 0
UserId: 1109
PrimaryGroupId: 513
GroupIds (GroupCount: 2): 513 (0x7), 512 (0x7)
UserFlags: 262176
LogonServer: DC-2016
LogonDomainName: TESTLOCAL
LogonDomainId: S-1-5-21-2322411092-424064500-325241940
UserAccountControl: 0x1210
FailedILogonCount: 0
ExtraSids (SidCount: 1):

S-1-18-1 (7)

ResourceGroupDomainSid: NULL
ResourceGroupIds (ResourceGroupCount: 0): NONE

[PAC_INFO_BUFFER 1] ulType: 0x2, cbBufferSize: 148, Offset: 0xac4c42e220

[PAC_CREDENTIAL_INFO] Version: 0, EncryptionType: 0x12

[PAC_CREDENTIAL_DATA] CredentialCount: 1

[SECPKG_SUPPLEMENTAL_CRED] PackageName: NTLM

[NTLM_SUPPLEMENTAL_CREDENTIAL]

Version: 0
Flags: 0x2
LmPassword: 00000000000000000000000000000000
NtPassword: bda85c1129d6b6a72fc993514df59e90

[PAC_INFO_BUFFER 2] ulType: 0xa, cbBufferSize: 20, Offset: 0xac4c42e2b8

[PAC_CLIENT_INFO]

ClientId: 0x01d3e860-0x4241f680
Name: admin

[PAC_INFO_BUFFER 3] ulType: 0xc, cbBufferSize: 72, Offset: 0xac4c42e2d0

[UPN_DNS_INFO]

Upn: admin@test.local
DnsDomainName: TEST.LOCAL
Flags: 0x0

[PAC_INFO_BUFFER 4] ulType: 0x6, cbBufferSize: 16, Offset: 0xac4c42e318

[PAC_SIGNATURE_DATA] Server Signature

SignatureType: 0x10
Signature: a60a426d5a916b44a4c190db

[PAC_INFO_BUFFER 5] ulType: 0x7, cbBufferSize: 20, Offset: 0xac4c42e328

[PAC_SIGNATURE_DATA] KDC Signature

SignatureType: 0xffffff76
Signature: 1b5ec6d6a73e9480686e3064eaddd708

enc-part: EncryptedData[EncASRepPart] etype: 0x12 (AES256_HMAC_SHA1_96)

[EncKDCRepPart]

key: [EncryptionKey] keytype: 0x12, keyvalue: a045b25d5a25841d09c19c6c7ad71500727d94d92ba1c28361815aa78f3c68f2
last-req: TODO
nonce 0x43801ec8
*key-expiration: 2037/09/14 02:48:05.0
flags: 0x40e10000 (name_canonicalize/enc_pa_rep, pre_authent, initial, renewable, forwardable)
authtime: 2018/05/10 13:10:25.0
starttime: 2018/05/10 13:10:25.0
endtime: 2018/05/10 23:10:25.0
*renew-till: 2018/05/17 13:10:25.0
srealm: TEST.LOCAL
sname: krbtgt/TEST.LOCAL (2)
*caddr:

addr-type: 20 (NetBios), address: WIN10

*encrypted-pa-data:

[PA-DATA]

[1] padata-type: 165 (PA-SUPPORTED-ENCTYPES), KerbSupportedEncryptionTypes: 0x5001f

05 - PKINIT (RSA) - AS_REP