Forest on MrAzoth https://az0th.it/tags/forest/ Recent content in Forest on MrAzoth Hugo -- 0.154.5 en-us Domain & Forest Trusts — From Kali https://az0th.it/ad/kali/domain-trusts/ Mon, 01 Jan 0001 00:00:00 +0000 https://az0th.it/ad/kali/domain-trusts/ <h2 id="quick-reference">Quick Reference</h2> <table> <thead> <tr> <th>Attack</th> <th>Requirement</th> <th>Tool</th> </tr> </thead> <tbody> <tr> <td>Cross-domain Kerberoasting</td> <td>Valid low-priv creds in child domain</td> <td>GetUserSPNs.py</td> </tr> <tr> <td>Cross-domain AS-REP Roasting</td> <td>Valid low-priv creds in child domain</td> <td>GetNPUsers.py</td> </tr> <tr> <td>SID History Injection (parent-child)</td> <td>Domain Admin in child domain, child krbtgt hash</td> <td>ticketer.py</td> </tr> <tr> <td>Cross-domain DCSync</td> <td>Replication rights or DA in target domain</td> <td>secretsdump.py</td> </tr> <tr> <td>One-way inbound trust abuse</td> <td>DA in trusted domain, inter-realm key</td> <td>ticketer.py (silver), getST.py</td> </tr> <tr> <td>One-way outbound trust abuse</td> <td>DA in trusting domain, TDO GUID</td> <td>secretsdump.py, getTGT.py</td> </tr> <tr> <td>Cross-forest Kerberoasting</td> <td>Bidirectional forest trust, valid creds</td> <td>GetUserSPNs.py</td> </tr> <tr> <td>Golden ticket cross-domain</td> <td>Child krbtgt hash + parent domain SID</td> <td>ticketer.py</td> </tr> <tr> <td>BloodHound trust mapping</td> <td>Valid creds, network access to DC</td> <td>bloodhound-python</td> </tr> </tbody> </table> <hr> <h2 id="trust-concepts">Trust Concepts</h2> <h3 id="trust-types">Trust Types</h3> <p>A <strong>Trust</strong> is a relationship between two domains that allows security principals in one domain to authenticate to resources in another. Trust information is stored in Active Directory as <strong>Trusted Domain Objects (TDOs)</strong> under <code>CN=System</code>.</p> Domain & Forest Trusts — From Windows https://az0th.it/ad/windows/domain-trusts/ Mon, 01 Jan 0001 00:00:00 +0000 https://az0th.it/ad/windows/domain-trusts/ Enumerating and exploiting Active Directory domain and forest trusts from a Windows foothold: SID history injection, golden ticket cross-domain, inter-realm key abuse.