🐧Child → Parent Trust Attacks - from Linux

🎯 HTB Academy: Active Directory Enumeration & Attacks

📍 Overview

Child → Parent Trust Attacks from Linux leverage the Impacket toolkit to perform ExtraSids attacks against Active Directory forests. This approach provides cross-platform capability for SID History exploitation, enabling Linux-based attackers to escalate from child domain compromise to complete forest control using Python-based tools.

🛠️ Linux Attack Methodology

Required Data Points (Same as Windows)

Component
Linux Collection Method
Example Value

KRBTGT hash

impacket-secretsdump DCSync

9d765b482771505cbe97411065964d5f

Child domain SID

impacket-lookupsid enumeration

S-1-5-21-2806153819-209893948-922872689

Target username

Arbitrary (can be fake)

hacker

Child domain FQDN

Target specification

LOGISTICS.INLANEFREIGHT.LOCAL

Enterprise Admins SID

impacket-lookupsid parent domain

S-1-5-21-3842939050-3880317879-2865463114-519

Step 1: KRBTGT Hash Extraction

# DCSync attack for KRBTGT account
impacket-secretsdump logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt

# Output extract:
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:9d765b482771505cbe97411065964d5f:::

Step 2: Child Domain SID Discovery

Step 3: Enterprise Admins SID Enumeration

Step 4: Golden Ticket Creation

Step 5: Environment Setup & Exploitation

🚀 Automated Attack Option

raiseChild.py - Complete Automation

Automation Workflow

🎯 HTB Academy Lab Solution

Lab Environment Setup

🎫 Question: "Perform the ExtraSids attack to compromise the parent domain from the Linux attack host. After compromising the parent domain obtain the NTLM hash for the Domain Admin user bross. Submit this hash as your answer."

Complete Verified Lab Solution:

Step 1: SSH to Linux Attack Host

Step 2: Automated ExtraSids Attack with raiseChild.py

Step 3: Extract Target User Credentials

🎯 Answer: 49a074a39dd0651f647e765c2cc794c7

Key Lab Insights:

  • raiseChild.py automation: Complete ExtraSids attack with single command

  • Credential extraction: Tool provides both child and parent domain credentials automatically

  • Administrator hash: 88ad09182de639ccc6579eb0849751cf extracted for further operations

  • Target achievement: bross user hash 49a074a39dd0651f647e765c2cc794c7 successfully obtained

⚠️ Tool Considerations

Manual vs Automated Approach

  • Manual methodology: Better understanding, troubleshooting capability, controlled execution

  • Automated tools: Faster execution but less control, potential production environment risks

  • Best practice: Understand manual process before using automation

Impacket Tool Prefix

Environment Variables

  • KRB5CCNAME: Points system to Kerberos credential cache file

  • Critical for ticket usage: Must be set before authentication attempts

  • Ticket persistence: ccache files enable reusable authentication

🔑 Key Takeaways

Cross-Platform Attack Capability

Critical Success Factors

  • Data consistency: Same 5 data points required as Windows approach

  • Tool proficiency: Understanding Impacket toolkit capabilities

  • Environment setup: Proper KRB5CCNAME configuration

  • Attack validation: Verification of parent domain access

Professional Value

  • Platform flexibility: Attack capability regardless of operating system

  • Tool diversification: Multiple approaches for same objective

  • Troubleshooting skills: Manual understanding enables problem resolution

  • Assessment completeness: Linux-based penetration testing capability

🐧 Linux-based Child → Parent trust attacks provide cross-platform forest compromise capability - demonstrating that sophisticated AD attacks can be executed effectively from any operating system using the powerful Impacket toolkit!

PreviousChild → Parent Trust AttacksNextCross-Forest Trust Abuse - from Windows

Last updated