Skip to content

Trust - Relationship

  • One-way
    • Domain B trusts A
    • Users in Domain A can access resources in Domain B
    • Users in Domain B cannot access resources in Domain A
  • Two-way
    • Domain A trusts Domain B
    • Domain B trusts Domain A
    • Authentication requests can be passed between the two domains in both directions

Enumerate trusts between domains

  • Native nltest
nltest /trusted_domains
  • PowerShell GetAllTrustRelationships
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

SourceName          TargetName                    TrustType      TrustDirection
----------          ----------                    ---------      --------------
domainA.local      domainB.local                  TreeRoot       Bidirectional
  • netexec module enum_trusts
nxc ldap <ip> -u <user> -p <pass> -M enum_trusts

Exploit trusts between domains

⚠ Require a Domain-Admin level access to the current domain.

Source Target Technique to use Trust relationship
Root Child Golden Ticket + Enterprise Admin group (Mimikatz /groups) Inter Realm (2-way)
Child Child SID History exploitation (Mimikatz /sids) Inter Realm Parent-Child (2-way)
Child Root SID History exploitation (Mimikatz /sids) Inter Realm Tree-Root (2-way)
Forest A Forest B PrinterBug + Unconstrained delegation ? Inter Realm Forest or External (2-way)

References