trust-key
Methodology
Dump the trust key of the child domain.
Check if SID Filtering is enabled.
Forge an inter-forest ticket.
Inject the ticket.
Enumerate group RID > 1000 on the target domain.
Forge an inter-forest ticket with special SIDS.
Inject the ticket
Powershell
[!INFO] Remember to follow the Powershell methodology
AD Module
Check if SID Filtering is enabled:
Get-ADTrust -Filter *Look for groups with RID higher than 1000 in the target machine:
Binaries
[!INFO] Remember to follow the Binaries methodology
SafetyKatz
Dump trust key for the inter-forest trust:
Rubeus
Forge an inter-realm TGT:
Inject the ticket:
[!INFO] We can only access specific resources that are explicitly shared!
Forge a TGS using inter-realm TGT:
Inject SID history of group with RID > 1000:
Request TGS with the TGT:
Last updated