Trust 👉🏻 a link between the authentication systems of two domains.
Transitive trust 👉🏻 the trust is extended to objects which the child domain trusts.
Non-transitive trust 👉🏻 only the child domain itself is trusted.
Bidirectional (two-way) trust 👉🏻 users from both trusting domains can access resources.
One-way trust 👉🏻 only users in a trusted domain can access resources in a trusting domain, not vice-versa (the direction of trust is opposite to the direction of access).
Some trust types:
Trust Type
Description
Parent-child
A trust between domains within the same forest. The child domain has a bidirectional transitive trust with the parent domain.
Cross-link (shortcut)
A trust between child domains (used to speed up authentication).
Tree-root (intra-forest)
A bidirectional transitive trust between a forest root domain and a new tree root domain. Created implicitly when a new domain tree is created in the forest.
Forest
A transitive trust between two forest root domains. Enforces SID filtering.
External (inter-forest)
A non-transitive trust between two separate domains in separate forests that are not already joined by a forest trust. Enforces SID filtering.
PV2 > Get-NetDomainTrust [-Domain megacorp.local] | ft
PV3 > Get-DomainTrust -API [-Domain megacorp.local] | ft
PV2 > Get-NetDomainTrust -LDAP [-Domain megacorp.local] | ft
PV3 > Get-DomainTrust [-Domain megacorp.local] | ft
Build domain trust mapping:
PV2 > Invoke-MapDomainTrust [-Domain megacorp.local] | ft
PV3 > Get-DomainTrustMapping [-Domain megacorp.local] | ft
Request a Foreign User TGT with Rubeus
Having just an RC4/AES keys of a user in target forest (that's a foreign user in target domain, but a native user in current domain), we can request Kerberos tickets manually with Rubeus.
Abusing Bidirectional ParentChild (WITHIN_FOREST) trust between child.megacorp.local ⟷ megacorp.local.
Check if SID filtering is enabled for a trust:
Cmd > netdom.exe trust child.megacorp.local /domain:megacorp.local /quarantine
SID filtering is not enabled for this trust. All SIDs presented in an
authentication request from this domain will be honored.
If SID history is enabled (e. g., if domain is on its migration period, netdom trust b.net /d:a.net /enablesidhistory:yes) then the forest trust is treated as external.
We can try to locate non-default (with RID greater than 1000) admin account:
If such an account is a member of a domain local security group (not a global group like Enterprise Admins or Domain Admins) and allows us to compromise a user or a computer in the target domain, we can create a cross-trust golden ticket for her the same way as described above.