Trust - Relationship

• One-way
  • Domain B trusts A
  • Users in Domain A can access resources in Domain B
  • Users in Domain B cannot access resources in Domain A
• Two-way
  • Domain A trusts Domain B
  • Domain B trusts Domain A
  • Authentication requests can be passed between the two domains in both directions

Enumerate trusts between domains#

• Native nltest

  nltest /trusted_domains
  

• PowerShell GetAllTrustRelationships

  ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
  
  SourceName          TargetName                    TrustType      TrustDirection
  ----------          ----------                    ---------      --------------
  domainA.local      domainB.local                  TreeRoot       Bidirectional
  

• netexec module enum_trusts

  nxc ldap <ip> -u <user> -p <pass> -M enum_trusts 
  

Exploit trusts between domains#

:warning: Require a Domain-Admin level access to the current domain.

References#

• External Trusts Are Evil - 14 March 2023 - Charlie Clark (@exploitph)
• Carlos Garcia - Rooted2019 - Pentesting Active Directory Forests public.pdf
• Training - Attacking and Defending Active Directory Lab - Altered Security