Added support for a custom additional ticket for S4U2Proxy

[ShutdownRepo]

In this blogpost Elad Shamir explains that Kerberos Constrained Delegations configured without Protocol Transition (a.k.a. with "Kerberos only" set) prevents a service from obtaining a forwardable TGS when conducting an S4U2Self. He demonstrates a technique using RBCD to bypass that. The steps are as follows

1. serviceA is configured for KCD Kerberos only
2. serviceA's msDs-AllowedToActOnBehalfOfOtherIdentity attribute is set to serviceB
3. serviceB's credentials are used to ask for admin's forwardable ticket for one of serviceA's SPNs (common rbcd abuse): getST.py -spn cifs/serviceA -impersonate admin domain/serviceB:password
4. serviceA's credentials are then used to operate an S4U2Proxy to obtain a forwardable TGS for admin to one of the services serviceA can delegate to. For this to work, the TGS obtained in step 3 has to be included as an additional ticket. This PR allows this step to work: getST.py -spn cifs/target -impersonate admin -additional-ticket admin.ccache domain/serviceA:password

[p0dalirius]

This is cool!! Congrats @ShutdownRepo

[ShutdownRepo]

50d1ec9 well that commit title was a failure 😢 the change was brought co-authored by @GeisericII

[0xdeaddood]

Hi @ShutdownRepo!

This is great! I left a couple of change requests related to typos.

Thanks a lot for this contribution!!!

[0xdeaddood]

Thanks again! It works great, merging....