## Distro

Windows Server 2019


## GSSAPI Impl

SSPI


## Connection Info:

Connecting to host using FQDN with explicit credentials with an SPN that is invalid.


## Notes

* The session key for this scenario was `l3pcY7rE3QlK77m2/xUXsQ==` - password was `VagrantPass1`


## Tokens

```yaml
MessageType: NEGOTIATE_MESSAGE (1)
Data:
  NegotiateFlags:
    raw: 3792208567
    flags:
    - NTLMSSP_NEGOTIATE_56 (2147483648)
    - NTLMSSP_NEGOTIATE_KEY_EXCH (1073741824)
    - NTLMSSP_NEGOTIATE_128 (536870912)
    - NTLMSSP_NEGOTIATE_VERSION (33554432)
    - NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY (524288)
    - NTLMSSP_NEGOTIATE_ALWAYS_SIGN (32768)
    - NTLMSSP_NEGOTIATE_NTLM (512)
    - NTLMSSP_NEGOTIATE_LM_KEY (128)
    - NTLMSSP_NEGOTIATE_SEAL (32)
    - NTLMSSP_NEGOTIATE_SIGN (16)
    - NTLMSSP_REQUEST_TARGET (4)
    - NTLMSSP_NEGOTIATE_OEM (2)
    - NTLMSSP_NEGOTIATE_UNICODE (1)
  DomainNameFields:
    Len: 0
    MaxLen: 0
    BufferOffset: 0
  WorkstationFields:
    Len: 0
    MaxLen: 0
    BufferOffset: 0
  Version:
    Major: 10
    Minor: 0
    Build: 17763
    Reserved: '000000'
    NTLMRevision: 15
  Payload:
    DomainName:
    Workstation:
RawData: 4E544C4D5353500001000000B78208E2000000000000000000000000000000000A0063450000000F
```

```yaml
MessageType: CHALLENGE_MESSAGE (2)
Data:
  TargetNameFields:
    Len: 12
    MaxLen: 12
    BufferOffset: 56
  NegotiateFlags:
    raw: 3800662581
    flags:
    - NTLMSSP_NEGOTIATE_56 (2147483648)
    - NTLMSSP_NEGOTIATE_KEY_EXCH (1073741824)
    - NTLMSSP_NEGOTIATE_128 (536870912)
    - NTLMSSP_NEGOTIATE_VERSION (33554432)
    - NTLMSSP_NEGOTIATE_TARGET_INFO (8388608)
    - NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY (524288)
    - NTLMSSP_TARGET_TYPE_DOMAIN (65536)
    - NTLMSSP_NEGOTIATE_ALWAYS_SIGN (32768)
    - NTLMSSP_NEGOTIATE_NTLM (512)
    - NTLMSSP_NEGOTIATE_SEAL (32)
    - NTLMSSP_NEGOTIATE_SIGN (16)
    - NTLMSSP_REQUEST_TARGET (4)
    - NTLMSSP_NEGOTIATE_UNICODE (1)
  ServerChallenge: 96E5D24791C91A89
  Reserved: '0000000000000000'
  TargetInfoFields:
    Len: 138
    MaxLen: 138
    BufferOffset: 68
  Version:
    Major: 10
    Minor: 0
    Build: 14393
    Reserved: '000000'
    NTLMRevision: 15
  Payload:
    TargetName: DOMAIN
    TargetInfo:
    - AvId: MSV_AV_NB_DOMAIN_NAME (2)
      Value: DOMAIN
    - AvId: MSV_AV_NB_COMPUTER_NAME (1)
      Value: DC01
    - AvId: MSV_AV_DNS_DOMAIN_NAME (4)
      Value: domain.local
    - AvId: MSV_AV_DNS_COMPUTER_NAME (3)
      Value: DC01.domain.local
    - AvId: MSV_AV_DNS_TREE_NAME (5)
      Value: domain.local
    - AvId: MSV_AV_TIMESTAMP (7)
      Value: '2020-05-07T10:44:56.9362104Z'
    - AvId: MSV_AV_EOL (0)
      Value:
RawData: 4E544C4D53535000020000000C000C0038000000358289E296E5D24791C91A8900000000000000008A008A00440000000A0039380000000F44004F004D00410049004E0002000C0044004F004D00410049004E000100080044004300300031000400180064006F006D00610069006E002E006C006F00630061006C000300220044004300300031002E0064006F006D00610069006E002E006C006F00630061006C000500180064006F006D00610069006E002E006C006F00630061006C0007000800B81EA78C5C24D60100000000
```

```yaml
MessageType: AUTHENTICATE_MESSAGE (3)
Data:
  LmChallengeResponseFields:
    Len: 24
    MaxLen: 24
    BufferOffset: 162
  NtChallengeResponseFields:
    Len: 288
    MaxLen: 288
    BufferOffset: 186
  DomainNameFields:
    Len: 0
    MaxLen: 0
    BufferOffset: 88
  UserNameFields:
    Len: 54
    MaxLen: 54
    BufferOffset: 88
  WorkstationFields:
    Len: 20
    MaxLen: 20
    BufferOffset: 142
  EncryptedRandomSessionKeyFields:
    Len: 16
    MaxLen: 16
    BufferOffset: 474
  NegotiateFlags:
    raw: 3800597045
    flags:
    - NTLMSSP_NEGOTIATE_56 (2147483648)
    - NTLMSSP_NEGOTIATE_KEY_EXCH (1073741824)
    - NTLMSSP_NEGOTIATE_128 (536870912)
    - NTLMSSP_NEGOTIATE_VERSION (33554432)
    - NTLMSSP_NEGOTIATE_TARGET_INFO (8388608)
    - NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY (524288)
    - NTLMSSP_NEGOTIATE_ALWAYS_SIGN (32768)
    - NTLMSSP_NEGOTIATE_NTLM (512)
    - NTLMSSP_NEGOTIATE_SEAL (32)
    - NTLMSSP_NEGOTIATE_SIGN (16)
    - NTLMSSP_REQUEST_TARGET (4)
    - NTLMSSP_NEGOTIATE_UNICODE (1)
  Version:
    Major: 10
    Minor: 0
    Build: 17763
    Reserved: '000000'
    NTLMRevision: 15
  MIC: B9E0D5D61693A4A69EE5073DDDB0CE55
  Payload:
    LmChallengeResponse:
      ResponseType: LMv1
      LMProofStr: '000000000000000000000000000000000000000000000000'
    NtChallengeResponse:
      ResponseType: NTLMv2
      NTProofStr: 1C0AD221C756F5E5EF7AB1F4A6142F80
      ClientChallenge:
        RespType: 1
        HiRespType: 1
        Reserved1: 0
        Reserved2: 0
        TimeStamp: '2020-05-07T10:44:56.9362104Z'
        ChallengeFromClient: 5C37F5C980152445
        Reserved3: 0
        AvPairs:
        - AvId: MSV_AV_NB_DOMAIN_NAME (2)
          Value: DOMAIN
        - AvId: MSV_AV_NB_COMPUTER_NAME (1)
          Value: DC01
        - AvId: MSV_AV_DNS_DOMAIN_NAME (4)
          Value: domain.local
        - AvId: MSV_AV_DNS_COMPUTER_NAME (3)
          Value: DC01.domain.local
        - AvId: MSV_AV_DNS_TREE_NAME (5)
          Value: domain.local
        - AvId: MSV_AV_TIMESTAMP (7)
          Value: '2020-05-07T10:44:56.9362104Z'
        - AvId: MSV_AV_FLAGS (6)
          Value:
            raw: 2
            flags:
            - MIC_PROVIDED (2)
        - AvId: MSV_AV_SINGLE_HOST (8)
          Value:
            Size: 48
            Z4: 0
            CustomData: '0100000000200000'
            MachineId: 4135E6AB9D279B8D0642C048E0C1F24D0A9017A55C35B1A184872FEDFA712BDC
        - AvId: MSV_AV_CHANNEL_BINDINGS (10)
          Value: '00000000000000000000000000000000'
        - AvId: MSV_AV_TARGET_NAME (9)
          Value: SERV\fake
        - AvId: MSV_AV_EOL (0)
          Value:
        Reserved4: 0
    DomainName:
    UserName: vagrant-domain@DOMAIN.LOCAL
    Workstation: SERVER2019
    EncryptedRandomSessionKey: 89253B3EBB43F7E3E6B51F6264806022
  SessionKey: 977A5C63BAC4DD094AEFB9B6FF1517B1
RawData:  
```
