External Forest Domain - OneWay (Inbound) or bidirectional
Learn & practice AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
In this scenario an external domain is trusting you (or both are trusting each other), so you can get some kind of access over it.
Enumeration
First of all, you need to enumerate the trust:
Get-DomainTrust
SourceName : a.domain.local --> Current domain
TargetName : domain.external --> Destination domain
TrustType : WINDOWS-ACTIVE_DIRECTORY
TrustAttributes :
TrustDirection : Inbound --> Inboud trust
WhenCreated : 2/19/2021 10:50:56 PM
WhenChanged : 2/19/2021 10:50:56 PM
# Get name of DC of the other domain
Get-DomainComputer -Domain domain.external -Properties DNSHostName
dnshostname
-----------
dc.domain.external
# Groups that contain users outside of its domain and return its members
Get-DomainForeignGroupMember -Domain domain.external
GroupDomain : domain.external
GroupName : Administrators
GroupDistinguishedName : CN=Administrators,CN=Builtin,DC=domain,DC=external
MemberDomain : domain.external
MemberName : S-1-5-21-3263068140-2042698922-2891547269-1133
MemberDistinguishedName : CN=S-1-5-21-3263068140-2042698922-2891547269-1133,CN=ForeignSecurityPrincipals,DC=domain,
DC=external
# Get name of the principal in the current domain member of the cross-domain group
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1133
DEV\External Admins
# Get members of the cros-domain group
Get-DomainGroupMember -Identity "External Admins" | select MemberName
MemberName
----------
crossuser
# Lets list groups members
## Check how the "External Admins" is part of the Administrators group in that DC
Get-NetLocalGroupMember -ComputerName dc.domain.external
ComputerName : dc.domain.external
GroupName : Administrators
MemberName : SUB\External Admins
SID : S-1-5-21-3263068140-2042698922-2891547269-1133
IsGroup : True
IsDomain : True
# You may also enumerate where foreign groups and/or users have been assigned
# local admin access via Restricted Group by enumerating the GPOs in the foreign domain.In the previous enumeration it was found that the user crossuser is inside the External Admins group who has Admin access inside the DC of the external domain.
Initial Access
If you couldn't find any special access of your user in the other domain, you can still go back to the AD Methodology and try to privesc from an unprivileged user (things like kerberoasting for example):
You can use Powerview functions to enumerate the other domain using the -Domain param like in:
Impersonation
Logging in
Using a regular method with the credentials of the users who is has access to the external domain you should be able to access:
SID History Abuse
You could also abuse SID History across a forest trust.
If a user is migrated from one forest to another and SID Filtering is not enabled, it becomes possible to add a SID from the other forest, and this SID will be added to the user's token when authenticating across the trust.
As a reminder, you can get the signing key with
You could sign with the trusted key a TGT impersonating the user of the current domain.
Full way impersonating the user
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Last updated