I come here asking a simple (yet confusing) question. I have extracted the folowing from cain & able:
In cain is is labeled as "Kerb5 PreAuth Hashes"
What is this? What am I looking at here?
Somehow, the password is contained (or obtainable) from this hash because I can manually guess a password (I Know what it is) and it will show as successful.
This makes no sense to me because in every explanation of Kerberos I have seen the password hash is not transferred over the network at any point.
Followup Question: If I want to import this into john the ripper what catagory does this fall into from here: http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats
Kerberos v5 TGT -OR- MS Kerberos 5 AS-REQ Pre-Auth