Trusts

One-way trust - Unidirectional: Users in the trusted domain can access resources in the trusting domain but the reverse is not true

Two-way trust - Bi-directional: Users of both domains can access resources in the other domain

Transitive: can be extended to establish trust relationships with other domains Nontransitive: can not be extended to other domains in the forest

Parent-child trust: yolo.domain.local is a child of domain.local. The trust is always two-way transitive

Tree-root trust: The trust is always two-way transitive

External trusts: Beetween two domains in differents forests when forests do not have a trust relationship. Non transitive

Enumerating Trust Relationships

Enumeration from Windows Host

PowerView

Checking Users in the Child Domain using Get-DomainUser

Netdom

NXC

TrustValidator

Validate potential security issues in Active Directory trust relationships

LogoGitHub - nullenc0de/trust-validator: Validates priv escalation of AD trustsGitHub

Child -> Parent Trust

Windows - Using Trust Tickets

It’s All About Trust – Forging Kerberos Trust Tickets to Spoof Access across Active Directory TrustsActive Directory & Azure AD/Entra ID Security

child.parent.local : child = current domain

parent.local: parent

  • Look for [In] trust key from child to parent

  • Forge an inter-realm TGT

  • Option 1: Abuse with Kekeo

LogoGitHub - NotScortator/asktgs_compiled: KEKEO_OLD executablesGitHub

  1. Get a TGS for a service in the target domain

Logoasktgs_compiled/asktgs.exe at master · NotScortator/asktgs_compiledGitHub
LogoReleases · gentilkiwi/kekeoGitHub

Ticket for other service (HOST and RPCSS for WMI, HTTP for Powershell Remoting and WinRM) can also be created

  1. Use the TGS to access the targeted service

Logoasktgs_compiled/kirbikator.exe at master · NotScortator/asktgs_compiledGitHub

  • Option 2: Abuse with Rubeus

or forge ticket

use forged ticket

Windows - Using krbtgth hash

  • Avoid suspicious logs by using DC group

LogoCertificates and Pwnage and Patches, Oh My!Medium

Or:

Or diamond

Windows - ExtraSids Attack

With Mimikatz

Obtaining KRBTGT NT hash

SID for the child domain - PowerView

Enterprise Admins Group SID - PowerView

At this point, we have gathered the following data points:

  • The KRBTGT hash for the child domain: 9d765b482771505cbe97411065964d5f

  • The SID for the child domain: S-1-5-21-2806153819-209893948-922872689

  • The name of a target user in the child domain (does not need to exist to create our Golden Ticket!): We'll choose a fake user: hacker

  • The FQDN of the child domain: LOGISTICS.INLANEFREIGHT.LOCAL

  • The SID of the Enterprise Admins group of the root domain: S-1-5-21-3842939050-3880317879-2865463114-519

Golden Ticket to access all resources within the parent domain

- With Rubeus

/rc4 flag is the NT hash for the KRBTGT account

When dealing with multiple domains and our target domain is not the same as the user's domain, we will need to specify the exact domain to perform the DCSync operation on the particular domain controller.

Linux - Step by step

KRBTGT Hash

SID child domain

Enterprise Admin Group SID

-> S-1-5-21-3842939050-3880317879-2865463114-519

Golden Ticket

Linux - RaiseChild.py - All in one

if

add IP in /etc/hosts

-debug to get more info

AD CS Abuse

LogoGitHub - MWR-CyberSec/AD-CS-Forest-Exploiter: Exploit AD CS misconfiguration allowing privilege escalation and persistence from any child domain to full forest compromiseGitHub

Domain Trust Abuse - AD CS

AD CS

Cross-Forest Trust Abuse

Only RID > 1000 SIDs will be allowed across the trust boundary - See SID history enabled

Windows - Using Trust Tickets

It’s All About Trust – Forging Kerberos Trust Tickets to Spoof Access across Active Directory TrustsActive Directory & Azure AD/Entra ID Security

  • Trust key for the inter-forest trust

  • Forge inter-forest TGT

  • Option 1: Abuse witk Kekeo

LogoGitHub - NotScortator/asktgs_compiled: KEKEO_OLD executablesGitHub

Get a TGS for a service in the target domain forest

Logoasktgs_compiled/asktgs.exe at master · NotScortator/asktgs_compiledGitHub

Use the TGS to access the targetedd service

Logoasktgs_compiled/kirbikator.exe at master · NotScortator/asktgs_compiledGitHub

Ticket for other service (HOST and RPCSS for WMI, HTTP for Powershell Remoting and WinRM) can also be created

  • Option 2: Abuse with Rubeus

or

SID history enabled - /enablesidhistory:yes

Enumerate trust

SIDFilteringForestAware is set to True, it means SIDHistory is enabled across the forest trust.

Only RID > 1000 SIDs will be allowed across the trust boundary.

Inject a SIDHistory for RID > 1000 to access resources accessible to that identity or group in the target trusting forest

Logo[MS-PAC]: SID Filtering and Claims TransformationMicrosoftLearn

SID: S-1-5-21-domain-RID

From Forest1 DC, create a TGT with SIDHistory of Forest1Admins group

Request a TGS:

Inject that into current session:

Or

Access the web machine using PSRemoting:

Mitigation

The following security controls should be implemented to mitigate a SID History compromise:

https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/detecting-and-mitigating-active-directory-compromises?s=03

Windows - Cross Forest Kerberoasting

  • CRTE

From forest1 to forest2

Enumerate named service accounts across forest trusts

Request a TGS

Crack

Hashes

  • CPTS

From inlanefreight.local - Powerview

Windows - Admin password reuse

Enumerate groups with users that do not belong to the domain, also known as foreign group membership

Linux - Cross Forest Kerberoast

-request flag added gives us the TGS ticket

Cross Forest Trust - TGT Delegation across

TGT Delegation is disabled by default and must be explicitly enabled across a trust for the trusted (target) forest

Enumeration

If TGT Delagation is enable, Unconstrained Delegation can be used

Trustee and Resource Delegation

Cross Forest Trust - Foreign Security Principals (FSP)

Enumeration

Cross Forest Trust - Bastion - PAM Trust

How NOT to use the PAM trust - Leveraging Shadow Principals for Cross Forest Attackswww.labofapenetrationtester.com
LogoTrust - Privileged Access Management - Internal All The Thingsswisskyrepo.github.io

PAM trust is usually enabled between a Bastion or Red forest and a production/user forest which it manages. Provides the ability to access the production forest with high privileges without using credentials of the bastion forest

Shadow Principals are created in the bastion domain which are then mapped to DA or EA groups SIDs in the production forest

On bastion DC, enumerate if there is a PAM trust:

Users members of the Shadow Prinicpals

PSRemoting session on bastion-dc and access production.local

Mitigation - One way domain trust

The following security controls should be implemented to mitigate a one-way domain trust bypass:

  • Limit access to Domain Controllers to only privileged users that require access. This reduces the number of opportunities for malicious actors to gain access to Domain Controllers.

  • Restrict privileged access pathways to Domain Controllers to jump servers and secure admin workstations using only the ports and services that are required for administration. Domain Controllers are classified as ‘Tier 0’ assets within Microsoft’s ‘Enterprise Access Model’.

  • Encrypt and securely store backups of Domain Controllers and limit access to only Backup Administrators. Backups of Domain Controllers need to be afforded the same security as the actual Domain Controllers. Malicious actors may target backup systems to gain access to critical and sensitive computer objects, such as Domain Controllers.

  • Only use Domain Controllers for AD DS and do not install any non-security-related services or applications. This reduces the attack surface of Domain Controllers as there are fewer services, ports and applications that may be vulnerable and used to compromise a Domain Controller.

  • Centrally log and analyse Domain Controller logs in a timely manner to identify malicious activity. Domain Controller logs provide a rich source of information that is important for investigating potentially malicious activity on Domain Controllers and in the domain.

  • Disable the Print Spooler service on Domain Controllers. For example, malicious actors have targeted the Print Spooler service on Domain Controllers as a technique to authenticate to a system they control to collect the Domain Controllers computer object password hash or TGT. Malicious actors can then use this to authenticate to the Domain Controller they coerced and gain administrative access.

LogoDetecting and mitigating Active Directory compromises | Cyber.gov.auwww.cyber.gov.au
PreviousDomain Password Audit ToolsNextPersistence

Last updated