Listen to this Post
Introduction
Active Directory (AD) trust exploitation is a critical technique in penetration testing, allowing attackers to pivot between domains and escalate privileges. In this guide, we break down how to abuse domain trust relationships to compromise both Domain Controllers (DCs) in a multi-domain environment, based on Tyler Ramsbey’s Vulnlab walkthrough.
Learning Objectives
- Understand how domain trust relationships can be exploited.
- Learn practical techniques for lateral movement between domains.
- Gain hands-on experience with tools like BloodHound, Mimikatz, and PowerView.
You Should Know
1. Enumerating Trust Relationships with PowerView
Command:
Get-DomainTrust -Domain vulnlab.local
What It Does:
This PowerView command lists all trust relationships for the specified domain, revealing potential attack paths.
Step-by-Step:
1. Import PowerView into your PowerShell session.
2. Run the command to enumerate trusts.
3. Identify bidirectional or unidirectional trusts for exploitation.
2. Abusing SID History for Privilege Escalation
Command (Mimikatz):
mimikatz sid::patch mimikatz sid::add /sam:attacker /new:administrator
What It Does:
Mimikatz can modify the SID history of an account, granting it elevated privileges across trusted domains.
Step-by-Step:
1. Gain initial foothold in the source domain.
2. Use Mimikatz to patch LSASS memory.
- Add a high-privilege SID to a compromised account.
3. Golden Ticket Attack Across Trusted Domains
Command (Mimikatz):
mimikatz kerberos::golden /user:fakeadmin /domain:vulnlab.local /sid:S-1-5-21-... /krbtgt:hash /sids:S-1-5-21-... /ptt
What It Does:
Generates a forged Kerberos ticket (Golden Ticket) to impersonate any user across trusted domains.
Step-by-Step:
- Extract the `krbtgt` hash from the source DC.
- Craft a Golden Ticket with the target domain’s SID.
- Pass the ticket into memory (
/ptt) for authentication.
4. Leveraging BloodHound for Trust-Based Attack Paths
Command (BloodHound Query):
MATCH p=(n)-[:TrustedBy1..]->(m) WHERE n.name = "VULNLAB.LOCAL" RETURN p
What It Does:
BloodHound visualizes trust-based attack paths, helping identify the shortest route to compromise both domains.
Step-by-Step:
1. Ingest AD data into BloodHound.
2. Run the query to map trust relationships.
3. Follow the attack path to escalate privileges.
5. DCSync Attack from a Trusted Domain
Command (Mimikatz):
mimikatz lsadump::dcsync /domain:target.local /user:administrator
What It Does:
Allows an attacker with sufficient rights to pull password hashes from a trusted domain’s DC.
Step-by-Step:
- Compromise an account with replication rights in the source domain.
- Execute DCSync to extract credentials from the target DC.
3. Use hashes for Pass-the-Hash or further exploitation.
What Undercode Say
- Key Takeaway 1: Trust relationships are often misconfigured, making them prime targets for lateral movement.
- Key Takeaway 2: Tools like Mimikatz and BloodHound streamline trust exploitation, reducing manual effort.
Analysis:
Domain trust attacks remain a high-risk threat due to legacy configurations and over-permissive trusts. Organizations must regularly audit trust relationships, enforce SID filtering, and monitor for anomalous replication requests.
Prediction
As cloud-hybrid environments grow, attackers will increasingly exploit cross-domain trust weaknesses. Future AD attacks may combine trust abuse with cloud identity flaws, necessitating zero-trust architectures.
For hands-on training, check out Tyler Ramsbey’s Phishing Course and his Vulnlab Walkthrough.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Tyler Ramsbey – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
