Skip to content
Pwnversity

Trust and Forest Abuse

A trust lets users of one domain authenticate in another. Organizations create them to share resources between domains in the same forest or across different forests (mergers, subsidiaries). For an attacker who already controls one domain, trusts are bridges to expand: depending on the type and direction of the trust, compromising one domain can lead directly to compromising another —and, within a forest, the real security boundary is the forest, not the domain.

Threat model

Section titled “Threat model”

Microsoft’s key concept: the domain is not a security boundary; the forest is. Within one forest, all domains trust Enterprise Admins and share the schema and configuration; compromising a child domain lets you escalate to the forest root. Across forests, the trust may be mitigated (SID filtering) or not, and that’s where the attacker looks for gaps: SID history, trust keys, and misconfigured trusts.

Concepts

Section titled “Concepts”
  • Direction: one-way or two-way; “A trusts B” means B can authenticate in A.
  • Transitivity: transitive (chains: if A↔B and B↔C, A reaches C) or not.
  • Intra-forest (between domains of the same forest, two-way and transitive by default) vs inter-forest (between forests, with SID filtering by default).

Red Team

Section titled “Red Team”

Enumeration

Section titled “Enumeration”
# enumerate domain and forest trusts
Get-DomainTrust            # PowerView
Get-DomainTrust -API
nltest /domain_trusts /all_trusts
# from Linux
nxc ldap <DC> -u user -p pass -M enum_trusts

BloodHound maps the trusts and, crucially, which principals of one domain hold privileges in another.

Escalation child domain → forest root

Section titled “Escalation child domain → forest root”

Within a forest, two classic techniques use the trust key or SID history to forge a ticket the root accepts:

  • SID History injection / cross-domain Golden Ticket: from the child domain (as child DA), forge a TGT that includes in its SID history the SID of the root’s Enterprise Admins group. The root, not filtering SIDs within the forest, accepts it → DA in the root.
# with the child domain's krbtgt + the root's Enterprise Admins SID
mimikatz # kerberos::golden /user:Administrator /domain:child.corp.local \
  /sid:<SID-child> /krbtgt:<hash> /sids:<SID-root>-519 /ptt
# impacket:
ticketer.py -nthash <krbtgt_child> -domain-sid <SID-child> -domain child.corp.local \
  -extra-sid <SID-root>-519 Administrator
  • Trust ticket (inter-realm TGT): use the trust key (dumped from the DC) to forge an inter-domain ticket directly.

Across forests (inter-forest)

Section titled “Across forests (inter-forest)”
  • If SID filtering is disabled (common in old “internal” or misconfigured trusts), SID history works across forests too → cross-forest escalation.
  • Trusts allowing SID history, foreign group membership (a user of forest A in a privileged group of forest B), and abuse of cross-forest ACLs found with BloodHound.
  • Kerberoasting/roasting across the trust (request TGSs of the other domain’s services).

Tools

Section titled “Tools”
  • mimikatz (kerberos::golden with /sids), impacket (ticketer.py, raiseChild.py — automates child→root).
  • PowerView / BloodHound — trust and foreign-relationship enumeration.
  • Rubeus — forging and using inter-realm tickets.

Impact

Section titled “Impact”

Expansion of a compromised domain to the whole structure: from a child domain to Enterprise Admin of the forest root, and —where SID filtering fails— from one forest to another. It’s how a “local” compromise becomes control of the whole organization.

Blue Team

Section titled “Blue Team”

Detection

Section titled “Detection”
  • Tickets with unusual SID history (SIDs from another domain, especially -519 Enterprise Admins); 4769 events with anomalous PAC.
  • Abnormal inter-domain authentications; use of foreign accounts in privileged groups.
  • Creation/use of Golden/Trust tickets (see Active Directory Persistence: TGT with no prior AS-REQ, anomalous lifetimes).

Telemetry

Section titled “Telemetry”

Monitor cross-domain/cross-forest authentications, PAC validation, and trust changes. Audit privileged group memberships with foreign SIDs.

Hardening

Section titled “Hardening”
  • Enable SID filtering (quarantine) on trusts, especially inter-forest; review legacy trusts that have it off.
  • Selective authentication on inter-forest trusts (only explicitly authorized accounts).
  • Minimize and audit trusts: remove unused ones; document direction/transitivity.
  • Protect the forest root as the highest Tier 0; separate administration per domain.
  • Watch foreign memberships in privileged groups and cross-domain ACLs (BloodHound).

Response

Section titled “Response”

If a trust was abused, assume compromise of the reached domain(s): rotate krbtgt (×2) of the affected domains and the trust keys, review memberships with foreign SIDs, and reconsider the trust architecture.

CVEs and real-world cases

Section titled “CVEs and real-world cases”
  • Child→root escalation via SID history is a standard technique (MITRE T1134.005 SID-History Injection, T1482 Domain Trust Discovery); raiseChild.py automates it.
  • Microsoft insists: “the domain is not a security boundary” — the basis of these attacks.
  • Inter-forest trusts without SID filtering have enabled forest-to-forest hops in assessments and real compromises documented by SpecterOps/Semperis.
  • Golden/Trust tickets appear in APT intrusions for persistence and cross-domain expansion.

Testing checklist

Section titled “Testing checklist”
  • Enumerate trusts (direction, transitivity, intra/inter-forest)
  • Are you DA of a child domain? → SID history to Enterprise Admins (root)
  • raiseChild.py / golden ticket with the root’s /sids
  • Dumped trust key → inter-realm trust ticket
  • Inter-forest: is SID filtering disabled?
  • Foreign memberships / cross-forest ACLs (BloodHound)
  • Blue: SID filtering and selective auth on the trusts?

References

Section titled “References”