swisskyrepo
/
InternalAllTheThings
mirror of https://github.com/swisskyrepo/InternalAllTheThings.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
InternalAllTheThings/docs/active-directory/trust-relationship.md

2.0 KiB
Raw Permalink Blame History

Trust - Relationship

  • One-way
    • Domain B trusts A
    • Users in Domain A can access resources in Domain B
    • Users in Domain B cannot access resources in Domain A
  • Two-way
    • Domain A trusts Domain B
    • Domain B trusts Domain A
    • Authentication requests can be passed between the two domains in both directions

Enumerate trusts between domains

  • Native nltest 
    nltest /trusted_domains
  • PowerShell GetAllTrustRelationships 
    ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

SourceName          TargetName                    TrustType      TrustDirection
----------          ----------                    ---------      --------------
domainA.local      domainB.local                  TreeRoot       Bidirectional
  • netexec module enum_trusts 
    nxc ldap <ip> -u <user> -p <pass> -M enum_trusts

Exploit trusts between domains

⚠️ Require a Domain-Admin level access to the current domain.

Source Target Technique to use Trust relationship
Root Child Golden Ticket + Enterprise Admin group (Mimikatz /groups) Inter Realm (2-way)
Child Child SID History exploitation (Mimikatz /sids) Inter Realm Parent-Child (2-way)
Child Root SID History exploitation (Mimikatz /sids) Inter Realm Tree-Root (2-way)
Forest A Forest B PrinterBug + Unconstrained delegation ? Inter Realm Forest or External (2-way)

References