search

dirkjanm / PKINITtools

Tools for Kerberos PKINIT and relaying to AD CS
MIT License
626 stars 77 forks source link

KDC has no support for PADATA type (pre-authentication data) #2

Open sharp-shooter opened 3 years ago

sharp-shooter commented 3 years ago

when I gettgt from a certificate ,I get error show below: python3 gettgtpkinit.py -cert-pfx ../temp/PetitPotam/host1.pfx -dc-ip 10.0.0.0.1 domain/test\$ test.ccache -v 1 ⨯ 2021-07-30 04:59:22,388 minikerberos INFO Loading certificate and key from file 2021-07-30 04:59:22,507 minikerberos INFO Requesting TGT Traceback (most recent call last): File "/home/kali/PKINITtools/gettgtpkinit.py", line 349, in main() File "/home/kali/PKINITtools/gettgtpkinit.py", line 345, in main amain(args) File "/home/kali/PKINITtools/gettgtpkinit.py", line 315, in amain res = sock.sendrecv(req) File "/usr/local/lib/python3.9/dist-packages/minikerberos-0.2.14-py3.9.egg/minikerberos/network/clientsocket.py", line 87, in sendrecv minikerberos.protocol.errors.KerberosError: Error Code: 16 Reason: KDC has no support for PADATA type (pre-authentication data)

dirkjanm commented 3 years ago

Does Rubeus give you the same error? This would indicate that the CA setup of the domain is not complete and the Kerberos service does not (yet) accept PKI based preauthentication.

sharp-shooter commented 3 years ago

Yes ,so how to resolve the issue, does this attack works?

jsdhasfeds commented 3 years ago

Hi. Try this "https://support.citrix.com/article/CTX218941". I got the same error and managed to solve it by removing an old certificate issued by a CA that no longer exists then issueing a new certificate using the new CA.

jarilaos commented 2 years ago

I share this in case someone has the same issue (KDC_ERR_PADATA_TYPE_NOSUPP) and is looking for solutions: https://github.com/AlmondOffSec/PassTheCert