Anyone got a clear idea of how ADSI authentication works with AD? When I bind using DirectoryEntry I can see in wireshark I get a TGS-REP, but no tickets in klist? Might be because I'm using alternative creds? I probably just need to read more stuff by @syfuhs.net 😂 - ThreadSky

About ThreadSky

hashford.bsky.social • 90 days ago

Anyone got a clear idea of how ADSI authentication works with AD? When I bind using DirectoryEntry I can see in wireshark I get a TGS-REP, but no tickets in klist? Might be because I'm using alternative creds? I probably just need to read more stuff by @syfuhs.net 😂

Comments

syfuhs.net•90 days ago

Are you supplying creds or using your active logon session? Klist only shows the active logon. You have to pass the ID of the supplied creds logon to see the cache.

hashford.bsky.social•90 days ago

Thanks for the reply! Supplying alternate creds explicitly

awakecoding.com•81 days ago

Different context, similar question: I can't find the tickets matching my RDP connections with the RDP ActiveX, and I have confirmed matching Kerberos traffic in Wireshark. The sessions use explicit credentials. How can I find the ID to pass to the klist command? Or just list what's available?

awakecoding.com•81 days ago

"klist sessions" is not very helpful in finding it. I'm logged in as domain administrator, but the RDP user with explicit credentials or even just the target machine name just doesn't show up in the list:

syfuhs.net•81 days ago

You'd need to find the LUID of that context. It might actually be gone by the time the connection has established since it doesn't necessarily need it anymore.

awakecoding.com•81 days ago

The fact that mimikatz can dump the credentials even after the RDP ActiveX has disconnected proves otherwise. I can't get any Kerberos tickets, but the sekurlsa::ssp mimikatz module sees them. They go away when the RDP process terminates

awakecoding.com•81 days ago

How can I find the LUID you're referring to? Is it a per-process thing? I'm searching for some weird CredSSP caching behavior that appears to be per-process: https://bsky.app/profile/awakecoding.com/post/3ld5o5kphqc2q

Posting Rules

Be respectful to others
No spam or self-promotion
Stay on topic
Follow Bluesky's terms of service

Comments

Posting Rules

Reply