Last updated
Last updated
When a child domain is added to a forest, it automatically creates a transitive, two-way trust with its parent. This can be found in the lab where dev.cyberbotic.io is a child domain of cyberbotic.io.
SourceName is the current domain, TargetName is the foreign domain, TrustDirection is the trust direction (bidirectional is two-way), and TrustAttributes: WITHIN_FOREST lets us know that both of these domains are part of the same forest which implies a parent/child relationship.
If we have Domain Admin privileges in the child, we can also gain Domain Admin privileges in the parent using a TGT with a special attribute called SID History. SID History was designed to support migration scenarios, where a user would be moved from one domain to another. To preserve access to resources in the "old" domain, the user's previous SID would be added to the SID History of their new account. When creating such a ticket, the SID of a privileged group (EAs, DAs, etc) in the parent domain can be added that will grant access to all resources in the parent.
This can be achieved using either a Golden or Diamond Ticket.
The process is the same as creating Golden Tickets previously, the only additional information required is the SID of a target group in the parent domain.
Create the golden ticket with Rubeus.
Then import it into a logon session and use it to access the domain controller in the parent.
The Rubeus diamond command also has a /sids parameter, with which we can supply the extra SIDs we want in our ticket.
If dev.cyberbotic.io also had a child (e.g. test.dev.cyberbotic.io), then a DA in TEST would be able to use their krbtgt to hop to DA/EA in cyberbotic.io instantly because the trusts are transitive.
There are also other means which do not require DA in the child. For example, you can also kerberoast and ASREProast across domain trusts, which may lead to privileged credential disclosure. Because principals in CYBER can be granted access to resources in DEV, you may find instances where they are accessing machines we have compromised. If they interact with a machine with unconstrained delegation, we can capture their TGTs. If they're on a machine interactively, such as RDP, we can impersonate them just like any other user.