KRB-ERROR (6) : KDC_ERR_C_PRINCIPAL_UNKNOWN

[techspence]

Has anyone run into this issue before? Ran into this while attempting to abuse an ESC1. I tried targeting a number of admin accounts, all resulted in the same error.

C:\Users\user1\Downloads>Rubeus.exe asktgt /user:itadmin /sid:<redacted> /certificate:cert.pfx /ptt
[*] Action: Ask TGT\r
[*] Using PKINIT with etype rc4_hmac and subject: CN=user1, OU=finance, OU=acmeusers, DC=acme, DC=local
[*] Building AS-REQ (w/ PKINIT preauth) for: 'itadmin'
\r[X] KRB-ERROR (66) : KRB_AP_ERR_USER_TO_USER_REQUIRED\r

[ThatTotallyRealMyth]

Do these users have a SPN set by any chance?

[techspence]

Honestly, it's been so long since this engagement, I can't remember. What would that impact if they did?

[ThatTotallyRealMyth]

Honestly, it's been so long since this engagement, I can't remember. What would that impact if they did?

It's because that error usually would be the one you get usually for accounts without SPNs. I would've suggested trying specifying the DC machine account.

[techspence]

Thanks for the info! I'll try to remember that if I come across this again.