Active Directory is widely used in enterprise environments to manage computers and users. Organizations frequently have multiple domains across one or more forests. This topology can complicate authentication and resource access during security assessments.
However, trust relationships (trusts) between domains can inadvertently simplify privilege escalation and domain compromise by allowing users and objects from one domain to access resources in another.
One of the most effective methods for enumerating trusts is to query LDAP for the Trusted Domain Object (TDO) using the objectClass=trustedDomain filter. You can use ldapsearch or run query 6 in LDAPPER (parameter -s 6):
ldapsearch -x -H ldap://172.16.128.148 -D "user01@domain.local" -w 'P@ssw0rd' -b "dc=domain,dc=local" -s sub "(objectClass=trustedDomain)"After you get the TDO, you need to check its attributes: this determines which attacks may be successful.
Assume you have a standard user account in the domain.local domain. If the domain2.test domain trusts the domain.local domain and Selective Authentication (controlled by the TRUST_ATTRIBUTE_CROSS_ORGANIZATION flag) is not configured, user and computer accounts from domain.local will be member of Authenticated Users in domain2.test, allowing standard Active Directory exploitation techniques. With a user account in domain.local, you can perform many actions in the domain2.test: for example, you can read SYSVOL and look for credentials or other useful information, perform Coercion attacks and Kerberoasting, or add a computer account (see screenshot).
To learn more on how to obtain information about domains and trusts, which parameters to pay attention to, and which attacks can be used to escalate privileges — read the article by our expert Irina Belyaeva: "Active Directory Trust Relationship Attacks".
