Fix preauth flow for hash/key auth and remove PA_PAC_REQUEST from probe

Two fixes:
- Move step 2 (authenticated AS-REQ) out of the password-only else
  block into its own if-preAuth-is-True block, fixing enc-part error
  when using NTLM hash or AES key authentication
- Remove PA_PAC_REQUEST from probe AS-REQ to match kinit exactly,
  fixing extra UDP-to-TCP fallback caused by larger KDC response

Author: aconite33

impacket/krb5/kerberosv5.py

@@ -276,10 +276,6 @@ def getKerberosTGT(clientName, password, domain, lmhash, nthash, aesKey='', kdcH
         return tgt, cipher, key, sessionKey
 
     # Step 1: Probe AS-REQ without PA_ENC_TIMESTAMP (matching kinit)
-    pacRequest = KERB_PA_PAC_REQUEST()
-    pacRequest['include-pac'] = requestPAC
-    encodedPacRequest = encoder.encode(pacRequest)
-
     asReq = AS_REQ()
     asReq['pvno'] = 5
     asReq['msg-type'] = int(constants.ApplicationTagNumbers.AS_REQ.value)
@@ -291,9 +287,6 @@ def getKerberosTGT(clientName, password, domain, lmhash, nthash, aesKey='', kdcH
     asReq['padata'][1] = noValue
     asReq['padata'][1]['padata-type'] = int(constants.PreAuthenticationDataTypes.PA_REQ_ENC_PA_REP.value)
     asReq['padata'][1]['padata-value'] = b''
-    asReq['padata'][2] = noValue
-    asReq['padata'][2]['padata-type'] = int(constants.PreAuthenticationDataTypes.PA_PAC_REQUEST.value)
-    asReq['padata'][2]['padata-value'] = encodedPacRequest
 
     reqBody = seq_set(asReq, 'req-body')
 
@@ -392,6 +385,7 @@ def getKerberosTGT(clientName, password, domain, lmhash, nthash, aesKey='', kdcH
             raise Exception('No Encryption Data Available!')
         key = cipher.string_to_key(password, encryptionTypesData[enctype], None)
 
+    if preAuth is True:
         # Step 2: Authenticated AS-REQ with PA_ENC_TIMESTAMP (matching kinit)
         timeStamp = PA_ENC_TS_ENC()
         now = datetime.datetime.now(datetime.timezone.utc)