🔗Domain Trusts Primer
🎯 HTB Academy: Active Directory Enumeration & Attacks
📍 Overview
Domain Trusts are authentication relationships between Active Directory domains/forests that allow users to access resources across domain boundaries. Understanding trust relationships is critical for penetration testers as they often provide unintended attack paths and "end-around" routes into target environments, especially in M&A scenarios where security may not have been properly considered during trust establishment.
🏗️ Domain Trust Types
Trust Classifications
Parent-child
Two-way transitive trust within same forest
Child domain ↔ Parent domain authentication
Cross-link
Trust between child domains
Speed up authentication between siblings
External
Non-transitive trust between separate forests
Business partnerships, limited access
Tree-root
Two-way transitive between forest root and new tree
New tree root domain creation
Forest
Transitive trust between forest root domains
Complete forest-to-forest access
ESAE
Bastion forest for AD management
High-security administrative isolation
Trust Properties
Transitivity:
Transitive: Trust extends through relationships (A→B→C = A→C)
Non-transitive: Direct trust only, no extension
Direction:
One-way: Trusted domain users access trusting domain resources
Bidirectional: Mutual access between both domains
🔍 Trust Enumeration Techniques
Method 1: Built-in AD Module
Method 2: PowerView
Method 3: netdom
Method 4: BloodHound
Pre-built query: "Map Domain Trusts"
Visual representation: Trust relationships and directions
Attack path analysis: Trust-based privilege escalation routes
🎯 HTB Academy Lab Solutions
Lab Environment Setup
🔍 Question 1: "What is the child domain of INLANEFREIGHT.LOCAL?"
Solution:
🎯 Answer: LOGISTICS.INLANEFREIGHT.LOCAL
Analysis: Look for TrustAttributes : WITHIN_FOREST to identify child domains.
🌲 Question 2: "What domain does INLANEFREIGHT.LOCAL have a forest transitive trust with?"
Solution:
🎯 Answer: FREIGHTLOGISTICS.LOCAL
Analysis: Look for TrustAttributes : FOREST_TRANSITIVE to identify forest trusts.
↔️ Question 3: "What direction is this trust?"
Solution:
🎯 Answer: Bidirectional
Analysis: TrustDirection : Bidirectional indicates mutual access between forests.
⚠️ Security Implications
Attack Vectors Through Trusts
Cross-domain privilege escalation: Compromise child → attack parent
Forest-to-forest attacks: External trust exploitation
Kerberoasting across trusts: Service accounts in trusted domains
"End-around" attacks: Target softer trusted domains for indirect access
Assessment Considerations
Scope verification: Ensure trusted domains are within Rules of Engagement
Trust purpose analysis: Legitimate business need vs security risk
Bidirectional risk: Mutual access increases attack surface
M&A trust reviews: Recently acquired companies may have weaker security posture
🔑 Key Takeaways
Trust Enumeration Workflow
Critical Trust Attributes
WITHIN_FOREST: Child domain relationship (high attack value)
FOREST_TRANSITIVE: External forest trust (lateral movement opportunity)
Bidirectional: Mutual access (increased attack surface)
Professional Impact
Reconnaissance foundation: Trust discovery enables advanced attack planning
Risk assessment: Understanding trust implications for organizational security
Attack path identification: Trust relationships often provide privilege escalation routes
🔗 Domain trust enumeration provides critical infrastructure mapping for advanced Active Directory attacks - essential foundation for trust-based privilege escalation and cross-domain exploitation!
Last updated