🖊️ Author: Nairuz Abulhul

🌐 Blog: R3dbuck3t

Table of Contents

Trusts Overview

<aside> 📌 There are four different types of trusts

• IntraForest trusts are trusts that happen with all domains within the forest. These trusts are transitive, meaning users in one domain can access information from other domains within the existing forest.
• InterForest trusts are trusts that happen between two (2) different forests. These trusts are transitive, meaning users in one forest can access resources in another (of course, the access permissions depend on the trust directions, one-way or two-ways).
• Shortcut trust is a domain-to-domain trust within the same forest created to optimize authentication and session ticket requests between domains. This trust leverages Kerberos authentication.
• External trusts are domain-to-domain trusts in which a domain trusts an external domain, a domain completely separate from itself and not within the same forest. This trust leverages NTLM for authentication and cannot use Kerberos.
• Kerberos is used to extend the Kerberos realm to include other realms that are not an active directory forest. It is not used very often. </aside>

Domain Directions

• There are two (2) type of Trust Directions:
  • Bi-directional trust allows ****sharing resources in both directions
  • One-way Trust: allows the resources within one domain/forest to be accessible to only specified trusted domains/forests. That trust doesn’t reciprocate; it is only one-way. It is like, “I trust you, but you don’t trust me.” . The arrowhead indicates the access direction (refer to Enumerating Domain Trusts in Active Directory article)

SID Filtering

<aside> 💡 Without SID Filtering, a user sends all of their tokens to the other trusted domain or forest that would give them the same level of privileges they have on their current domain. For example, if a user is a member of a domain admins group in one domain, they would automatically be domain admins in the other trusted domain when logged into it.

With SID Filtering, a user sends only a specific token to the other trusted domains/forest. The filter removes all the SIDs for built-in privileged groups before allowing the user to access the resources in the other trusted domain.

</aside>

Tools

• Active Directory Module
• PowerView

<aside> 📌 You might need to bypass AMSI

</aside>

Map Domain Trusts

PowerView

List all domain trusts of the current domain

**Get-NetDomainTrust**

Get all the available trusts of the specific identified domain/child-domain