Walking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities
summary
Demonstrates a practical Kerberos/forest-trust exploit that forges inter‑realm TGTs and injects a victim host’s local SID (e.g. RID 500) into tickets so a member server in the trusted forest accepts admin rights. Technique uses the NETLOGON call netr_GetForestTrustInformation, hooks LSASS to swap returned SIDs (Frida-style interception), and builds silver/golden tickets with Impacket, Mimikatz/Ko to gain C: drive/system access; works on member servers (not DCs) and was fixed by MS patches.
AI-written summary · about
chapters (20)
- 0:00Introduction to Kerberos
- 1:03TGT and Service Tickets
- 2:53Authentication Workflow
- 4:41Common Kerberos Attacks
- 5:28Understanding Forest Trusts
- 7:13SID Filtering Explained
- 8:44Research Assumptions
- 9:52Trust Transitivity
- 12:18Dynamic Trust Updates
- 14:01Exploiting Trust Keys
- 15:41Local vs. Domain Trusts
- 17:24Local Admin Spoofing
- 20:33The Trust Attack Design
- 22:13Obtaining Local SIDs
- 23:55LSASS Hooking Technique
- 27:38Attack Demonstration
- 29:08Forging Inter-realm Tickets
- 30:48Attacking with Mimikatz
- 32:22Mitigation and Disclosure
- 33:21Conclusion
related talks
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
37mThreat Hunting in Active Directory Environment
50mBeyond the Mcse: Active Directory for the Security Professional
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
50mWatching The Watchdog: Protecting Kerberos Authentication With Network Monitoring
50mHybrid Active Directory Attacks: Anatomy and Defenses
45mFinding Our Path: How We're Trying to Improve Active Directory Security