cross forest trust abuse

The problem

Attacking a forest trust often stalls after gaining Domain Admin in the initial forest. Standard tools like impacket fail with obscure errors, and forged tickets are frequently stripped by SID filtering without clear feedback.

What it does

• Evaluates trustAttributes bitmasks to determine if a trust is quarantined or clean before attempting exploitation.
• Executes the SID history golden ticket attack for clean trusts, including mandatory RID hardening for Server 2025.
• Identifies and exploits well-known SID vulnerabilities (Authenticated Users, Everyone) when SID filtering is enforced.
• Leverages coercion chains and unconstrained delegation to capture machine account TGTs across forest boundaries.

Frameworks & tools

Impacket (ticketer, secretsdump, lookupsid), BloodHound, Samba-tool, MIT Kerberos (ksu), and LDAP.

Why this beats prompting it yourself

General LLMs often suggest DCSync attacks that fail across trusts due to NC mismatches. This skill provides the specific logic for bypassing SID filtering and handles the technical nuances of SMB3 backup flags and MIT Kerberos interactive shell traps that generic prompts miss.

Use cases

• Pivoting from a compromised child forest to a parent forest via SID history.
• Escalating privileges in a quarantined trust by hunting for misconfigured well-known SID ACEs.
• Compromising Linux members in a Kerberos realm using the ksu interactive bypass.
• Deploying exploit dependencies to air-gapped target environments using offline wheel pipelining.

Known limitations

Requires Domain Admin credentials or the krbtgt AES key from the source forest. Impacket 0.13 does not support the necessary SMB3 flags for direct remote SAM/NTDS reads via SeBackupPrivilege.