Active Directory Forest Trust Abuse Enables Child-to-Root Escalation
Summary
An authorized lab walkthrough demonstrates two paths from child-domain admin to forest-root compromise: a forged Golden Ticket with SID History and PetitPotam coercion. It also outlines mitigations including limiting delegation and monitoring DCSync.
Key points
- In the lab, a child-domain administrator could not initially access the parent domain controller, but the walkthrough shows how a within-forest trust enabled escalation.
- Rubeus forges a cross-domain Golden Ticket using the child domain’s krbtgt hash and injects the parent Enterprise Admins SID through ExtraSids.
- The forged ticket enables access to the forest root, LSA secret harvesting, DCSync, and a SYSTEM shell.
- An alternative path uses PetitPotam and unconstrained delegation to capture the forest root DC$ ticket and perform DCSync without forging a Golden Ticket.
- The article recommends treating every domain controller as tier-zero infrastructure, restricting delegation, enabling SID filtering where feasible, and monitoring unusual DCSync activity and Kerberos ExtraSids.
Article Details
- Topic
- Active Directory forest escalation through SID History abuse and PetitPotam coercion
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//192[.]168[.]1[.]17/Rubeus.exe | Rubeus payload download URL hosted on the attacker’s web server in the lab demonstration. |
MITRE ATT&CK
T1003.003 · NTDSThe attacker remotely dumps the child domain NTDS database to obtain the krbtgt hash.T1003.004 · LSA SecretsThe attacker harvests Local Security Authority secrets from the forest root.T1003.006 · DCSyncThe attacker performs DCSync to retrieve domain account secrets from the forest root.T1134.005 · SID-History InjectionThe forged ticket injects the parent Enterprise Admins SID through the ExtraSids field.T1187 · Forced AuthenticationPetitPotam coerces the forest root domain controller to authenticate to the attacker-controlled child domain controller.T1482 · Domain Trust DiscoveryThe attacker enumerates the child-to-parent domain trust using multiple tools.T1550.003 · Pass the TicketThe attacker passes the forged Kerberos ticket to access the forest root.T1558.001 · Golden TicketThe attacker forges a cross-domain Golden Ticket using the child domain krbtgt hash.T1569.002 · Service ExecutionImpacket psexec is used to obtain an interactive SYSTEM shell on a domain controller.
Products
Microsoft Active DirectoryThis article walks through a complete forest compromise of an Active Directory environment, escalating from a single child domain all the way to the forest root.Microsoft Windowsa pass-the-ticket attack unlocks the forest root domain controller, secrets are harvested from both Windows and Linux, the entire escalation is automated with a single NetExec module, and the forest finally falls
Tools
bloodyadTrust confirmation with bloodyADEvil-WinRMTo prove this boundary, the attacker connects to the child domain controller from Kali using Evil-WinRM as raaz, then attempts to read the administrative C$ share of the parent domain controller dc.ignite.local.ImpacketTrust confirmation with Impacket and nltestNetExec#pentestlocalPetitPotamIt also shows an alternative coercion-based path using PetitPotam to capture the forest root DC$ ticket and complete a full DCSync.PyWerViewTrust details with PyWerViewRubeus#pentestlocal