circle-check
Visit official github page
Certified Red Team Professional (CRTP) - Notesarrow-up-right
search

vial4 - Learning Object 4️

hashtag
Tasks

1 - Enumerate all domains in the moneycorp.local forest

2 - Map the trusts of the dollarcorp.moneycorp.local domain

3 - Map External trusts in moneycorp.local forest

4 - Identify external trusts of dollarcorp domain. Can you enumerate trusts for a trusting forest?

Flag 4 [Student VM] - Trust Direction for the trust between dollarcorp.moneycorp.local and eurocorp.local 🚩

hashtag
Solutions

hashtag
1 - Enumerate all domains in the moneycorp.local forest

Start InviShell and PowerView

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
. C:\AD\Tools\Powerview.ps1

Using Get-ForestDomain we obtain all domains relative to moneycorp.local forest

Get-DomainTrust -Domain dollarcorp.moneycorp.local | select TargetName,TrustAttributes,TrustDirection
TargetName                    TrustAttributes TrustDirection
----------                    --------------- --------------
moneycorp.local               WITHIN_FOREST   Bidirectional
us.dollarcorp.moneycorp.local WITHIN_FOREST   Bidirectional
eurocorp.local                FILTER_SIDS     Bidirectional

hashtag
2 - Map the trusts of the dollarcorp.moneycorp.local domain

Using Get-DomainTrust command we're able to retrieve Trusts and relative direction for dollarcorp.moneycorp.local domain

hashtag
3 - Map External trusts in moneycorp.local forest

Using Get-DomainTrust and the trust attribute "FILTER_SIDS" we can display all external trust relationship. Enabling FILTER_SIDS ensures that only the primary SID is considered during authorization, ignoring any SIDHistory.

As saw in the last tasks, the current forest is moneycorp.local, so it's not necessary to specify it.

hashtag
4 - Identify external trusts of dollarcorp domain. Can you enumerate trusts for a trusting forest?

We just know these information regarding dollarcorp domain

and the relative external trust:

To answer at the question: "Can you enumerate trusts for a trusting forest?" Remembering that the external forest is: eurocorp.local, we can enurate all domains of the forest checking the domain trust:

There's an error message because we can't enumerate trusts of a domain for which we haven't visibility into.

In addition, if we try to check forest domain for eurocorp.local, we can't extract full informations

hashtag
Flag 4 [Student VM] - Trust Direction for the trust between dollarcorp.moneycorp.local and eurocorp.local 🚩

The trust direction between dollarcorp.moneycorp.local and eurocorp.local can be determined by inspecting the TrustDirection field using:

Previous3 - Learning Object 3️Next5 - Learning Object 5️

Last updated