🛠️Trust Attacks

Enumeration

Import-Module activedirectory
Get-ADTrust -Filter *
Import-Module .\Powerview.ps1
Get-DomainTrust
Get-DomainTrustMapping

Checking Users in the Child Domain using Get-DomainUser

Get-DomainUser -Domain LOGISTICS.INLANEFREIGHT.LOCAL | select SamAccountName

Using netdom to query domain trust

netdom query /domain:inlanefreight.local trust

Using netdom to query domain controllers

netdom query /domain:inlanefreight.local dc

Using netdom to query workstations and servers

netdom query /domain:inlanefreight.local workstation

Attacking Domain Trust Child - Parent Trust from Windows

SID History Primer

The sidHistory attribute is used in migration scenarios. If a user in one domain is migrated to another domain, a new account is created in the second domain. The original user's SID will be added to the new user's SID history attribute, ensuring that the user can still access resources in the original domain. SID history is intended to work across domains, but can work in the same domain. Using Mimikatz, an attacker can perform SID history injection and add an administrator account to the SID History attribute of an account they control. When logging in with this account, all of the SIDs associated with the account are added to the user's token.

This token is used to determine what resources the account can access. If the SID of a Domain Admin account is added to the SID History attribute of this account, then this account will be able to perform DCSync and create a Golden Ticket or a Kerberos ticket- granting ticket (TGT), which will allow for us to authenticate as any account in the domain of our choosing for further persistence.

  • https://www.thehacker.recipes/ad/persistence/sid-history

Extra SID - Mimikatz

This attack allows for the compromise of a parent domain once the child domain has been compromised.

  • The KRBTGT hash for the child domain

  • The SID for the child domain

  • The name of a target user in the child domain (does not need to exist!)

  • The FQDN of the child domain.

  • The SID of the Enterprise Admins group of the root domain.

  • With this data collected, the attack can be performed with Mimikatz

Obtaining the KRBTGT Account's NT Hash using Mimikatz

Get-DomainSID We can use the PowerView Get-DomainSID function to get the SID for the child domain, but this is also visible in the Mimikatz output above

**Obtaining Enterprise Admins Group's SID using Get-DomainGroup

  • The KRBTGT hash for the child domain: 9d765b482771505cbe97411065964d5f

  • The SID for the child domain: S-1-5-21-2806153819-209893948-922872689

  • The name of a target user in the child domain (does not need to exist to create our Golden Ticket!): We'll choose a fake user: hacker

  • The FQDN of the child domain: LOGISTICS.INLANEFREIGHT.LOCAL

  • The SID of the Enterprise Admins group of the root domain: S-1-5-21-3842939050-3880317879-2865463114-519

Creating Golden Ticket with Mimikatz

Confirming a Kerberos Ticket is in Memory Using klist

Extra-Sid Attack - Rubeus

Performing a DCSync Attack

Attacking Domain Trust Child - Parent Trust from Linux

We'll still need to gather the same bits of information

  • This attack allows for the compromise of a parent domain once the child domain has been compromised.

  • The KRBTGT hash for the child domain

  • The SID for the child domain

  • The name of a target user in the child domain (does not need to exist!)

  • The FQDN of the child domain.

  • The SID of the Enterprise Admins group of the root domain.

Performing DCSync using secretsdump.py in Child

Performing SID Burte Forcing using lookupsid.py

Looking for the Domain SID

Grabbing the Domain SID & Attaching to Enterprise Admin's RID

  • The KRBTGT hash for the child domain: 9d765b482771505cbe97411065964d5f

  • The SID for the child domain: S-1-5-21-2806153819-209893948-922872689

  • The name of a target user in the child domain (does not need to exist!): hacker

  • The FQDN of the child domain: LOGISTICS.INLANEFREIGHT.LOCAL

  • The SID of the Enterprise Admins group of the root domain: S-1-5-21-3842939050- 3880317879-2865463114-519

Constructing a Golden Ticket using ticketer.py

Performing the Attack with raiseChild.py

Attacking Domain Trusts - Cross-Forest Trust Abuse - from Windows

Cross-Forest Kerberoasting

Enumerating Accounts for Associated SPNs Using Get-DomainUser

Enumerating the mssqlsvc Account

Performing a Kerberoasting Attacking with Rubeus Using /domain Flag

Admin Password Re-Use & Group Membership

From time to time, we'll run into a situation where there is a bidirectional forest trust managed by admins from the same company.

Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux

Cross-Forest Kerberoasting

Hunting Foreign Group Membership with Bloodhound-python

  • First domain

  • Second domain

Upload both data (first and second domain) to bloodhound and select:

  • Users with Foreign Domain Group Membership

PreviousKerberos Attack CheatsheetNextLinux Privilege Escalation

Last updated