trust-key

Methodology

  1. Dump the trust key of the child domain.

  2. Check if SID Filtering is enabled.

  3. Forge an inter-forest ticket.

  4. Inject the ticket.

  5. Enumerate group RID > 1000 on the target domain.

  6. Forge an inter-forest ticket with special SIDS.

  7. Inject the ticket

Powershell

[!INFO] Remember to follow the Powershell methodology

AD Module

Check if SID Filtering is enabled:

Get-ADTrust -Filter *

Look for groups with RID higher than 1000 in the target machine:

Binaries

[!INFO] Remember to follow the Binaries methodology

SafetyKatz

Dump trust key for the inter-forest trust:

Rubeus

Forge an inter-realm TGT:

Inject the ticket:

[!INFO] We can only access specific resources that are explicitly shared!

Forge a TGS using inter-realm TGT:

Inject SID history of group with RID > 1000:

Request TGS with the TGT:

Last updated