<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Jo, can you change the message type from 0x00000026 ( byte sequence seen as 26 00 00 00 below) to 0x00000003 (to indicate message type of KerbVerifyPacMessage) and try this again ?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
0:002> db ProtocolSubmitBuffer L0x5e0</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
00000218`69819c80 26 00 00 00 00 00 11 00-21 00 31 00 c0 05 00 00 &.......!.1.....</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
00000218`69819c90 00 00 02 00 00 00 00 00-00 00 00 00 c0 05 00 00 ................</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
00000218`69819ca0 61 82 05 bc 30 82 05 b8-a0 03 02 01 05 a1 0d 1b a...0...........</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
.. ..... .. ..... .. .....</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
.. ..... .. ..... .. .....</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
.. ..... .. ..... .. .....</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
00000218`6981a250 85 1d 35 87 38 7d b1 5b-52 c0 c3 e4 30 c8 77 7d ..5.8}.[R...0.w}</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Regards,</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Sreekanth Nadendla</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Microsoft Windows Open
Specifications</span></p>
</div>
<div id="appendonsend"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div dir="ltr" id="divRplyFwdMsg"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Jo Sutton <jsutton@samba.org><br>
<b>Sent:</b> Tuesday, July 2, 2024 6:23 PM<br>
<b>To:</b> Sreekanth Nadendla <srenaden@microsoft.com>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> [EXTERNAL] Re: [cifs-protocol] [MS-APDS] NETLOGON_TICKET_LOGON_INFO message - TrackingID#2405210040011397</span>
<div class="elementToProof"> </div>
</div>
<div style="font-size: 11pt;">Thank you, Sreekanth. I$B!G(Bve uploaded a trace and network capture of a<br>
call to NetrLogonSamLogonEx() attempting to validate a service ticket.<br>
<br>
Cheers,<br>
Jo (she/her)<br>
<br>
On 3/07/24 2:02 am, Sreekanth Nadendla wrote:<br>
> Hello Jo, you may have gotten an invitation to upload files by now.<br>
> Please check your e-mail folders and let me know otherwise.<br>
><br>
> Regards,<br>
><br>
> Sreekanth Nadendla<br>
><br>
> Microsoft Windows Open Specifications<br>
><br>
> ------------------------------------------------------------------------<br>
> *From:* Jo Sutton <jsutton@samba.org><br>
> *Sent:* Monday, July 1, 2024 10:01 PM<br>
> *To:* Sreekanth Nadendla <srenaden@microsoft.com>;<br>
> cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
> *Cc:* Microsoft Support <supportmail@microsoft.com><br>
> *Subject:* [EXTERNAL] Re: [cifs-protocol] [MS-APDS]<br>
> NETLOGON_TICKET_LOGON_INFO message - TrackingID#2405210040011397<br>
> On second thoughts, I$B!G(Bd rather not send traces via unencrypted email.<br>
> Can you provide somewhere for me to upload them?<br>
><br>
> Cheers,<br>
> Jo (she/her)<br>
><br>
> On 2/07/24 1:57 pm, Jo Sutton via cifs-protocol wrote:<br>
>> [moving back to cifs-protocol]<br>
>><br>
>> Hi Sreekanth,<br>
>><br>
>> Call me Jo :)<br>
>><br>
>> As I can$B!G(Bt seem to upload the traces via the link you sent me, I$B!G(Bll try<br>
>> to email them to you directly.<br>
>><br>
>> The reason for asking about NETLOGON_TICKET_LOGON_INFO is that we$B!G(Bre<br>
>> looking to address <a href="https://bugzilla.samba.org/show_bug.cgi?id=15249" id="OWAae8e9acc-8e21-1447-0fb4-193af5add0fe" class="OWAAutoLink" data-auth="NotApplicable">
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C75a58a64714f49fb27ff08dc9ae5974e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638555558091508750%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=HMGP0yGxJKmnWCLFOEqNFxhu4wmRTFFEkmMglpvvdsk%3D&reserved=0</a> <<a href="https://bugzilla.samba.org/show_bug.cgi?id=15249" id="OWA01620d78-69f3-fd47-5d5b-e4f06c23abec" class="OWAAutoLink" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C75a58a64714f49fb27ff08dc9ae5974e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638555558091515894%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=nk4AC9bEfOPKGFmU2TfyeuKEf1%2B10GWmqe82CuXJ9Cg%3D&reserved=0</a>>.<br>
>><br>
>> Cheers,<br>
>> Jo (she/her)<br>
>><br>
>> On 14/06/24 3:39 am, Sreekanth Nadendla wrote:<br>
>>> Hello Joseph, I've sent you instructions to download time travel trace<br>
>>> tool to collect traces for lass process earlier. But we were informed<br>
>>> by Andrew Bartlet that the reason why you've raised the login issue<br>
>>> with [MS-APDS] NETLOGON_TICKET_LOGON_INFO is that you are looking to<br>
>>> resolve a privilege escalation problem via enforcement of PAC<br>
>>> verification. I could not see how these two issues are connected<br>
>>> hence I'm unable to continue the investigation on my own (while you<br>
>>> are away dealing with a personal issue).<br>
>>> Please let us know whenever you are ready and we will gather the<br>
>>> details, data to investigate the issue you are experiencing.<br>
>>><br>
>>> Regards,<br>
>>><br>
>>> Sreekanth Nadendla<br>
>>><br>
>>> Microsoft Windows Open Specifications<br>
>>><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> From: Jo Sutton <jsutton@samba.org><br>
>>><br>
>>> Sent: Monday, May 20, 2024 9:49 PM<br>
>>> To: cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org>;<br>
>>> Interoperability Documentation Help <dochelp@microsoft.com><br>
>>> Subject: [EXTERNAL] [MS-APDS] NETLOGON_TICKET_LOGON_INFO message<br>
>>> [Some people who received this message don't often get email from<br>
>>> jsutton@samba.org. Learn why this is important at<br>
>>> <a href="https://aka.ms/LearnAboutSenderIdentification" id="OWAb693dbf7-dd1c-1ca2-4e68-d200b5b128fc" class="OWAAutoLink" data-auth="NotApplicable">
https://aka.ms/LearnAboutSenderIdentification</a><br>
> <<a href="https://aka.ms/LearnAboutSenderIdentification" id="OWA0790912e-60ce-4461-57a3-6ba49b98b306" class="OWAAutoLink" data-auth="NotApplicable">https://aka.ms/LearnAboutSenderIdentification</a>> ]<br>
>>><br>
>>> Hi dochelp,<br>
>>><br>
>>> I$B!G(Bm trying to follow [MS-APDS] 2.2.2.1, $B!H(BNETLOGON_TICKET_LOGON_INFO<br>
>>> Message$B!I(B, in order to create a NETLOGON_TICKET_LOGON_INFO message that<br>
>>> will be accepted by Windows Server 2019. However, in my attempts so far,<br>
>>> all I$B!G(Bve got is STATUS_INVALID_PARAMETER codes from NetrLogonSamLogonEx.<br>
>>><br>
>>> Although [MS-APDS] doesn$B!G(Bt mention it, I assume<br>
>>> NETLOGON_TICKET_LOGON_INFO should contain an unsigned 32$B!>(Bbit MessageType<br>
>>> field, set to 0x00000026, that indicates the message is a<br>
>>> NETLOGON_TICKET_LOGON_INFO message. Other than that, I$B!G(Bm not sure what<br>
>>> I$B!G(Bm doing wrong. Are the ticket fields arrays, are depicted in the<br>
>>> diagram, or pointers, as claimed in the documentation?<br>
>>><br>
>>> I can provide traces showing the problem if you would like.<br>
>>><br>
>>> Cheers,<br>
>>> Jo (she/her)<br>
>><br>
>><br>
>> _______________________________________________<br>
>> cifs-protocol mailing list<br>
>> cifs-protocol@lists.samba.org<br>
>> <a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" id="OWA52639eaa-8905-9c2e-b119-cafcf2a0e75e" class="OWAAutoLink" data-auth="NotApplicable">
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C75a58a64714f49fb27ff08dc9ae5974e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638555558091520380%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=tGxKsECefd%2BvJi43VcUG9n3OCpSX0btiR%2F91JNmOBU0%3D&reserved=0</a> <<a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" id="OWAe33eefba-85b7-8ddb-d529-b11a603d4d7d" class="OWAAutoLink" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C75a58a64714f49fb27ff08dc9ae5974e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638555558091524297%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=GorMFBW%2BtUUedY7w9Cv1aExzAv%2F0LpAmIqVUJGeq8jE%3D&reserved=0</a>></div>
</body>
</html>