Learn how an incoming one-way trust, sometimes used as "Active Directory Red Forest Design" or "Enhanced Security Administrative Environment" (ESAE), still constitute a security risk for the trusted domain/Red Forest if attackers have control of the trusting domain. This risk was reported to @Microsoft but will not be patched any time soon. Possible mitigations and detections are, as always, included in the post.

In part 5 of this series, we explored how the replication of Configuration naming context (NC) allows for the GoldenGMSA trust attack. Exploring what else is stored in Configuration we find the AD Schema, and this post explores how this schema replication allows a child domain to modify the schema and thereby compromise objects in the parent domain, just as if you were a Schema Admin (a group only existing in the root/parent domain of AD).

In part 4 of this series, we saw how the replication of Configuration naming context (NC) to child domains allows for the GPO on site attack. Right after discovering this, the GoldenGMSA tool by Yuval Gordon was released, which makes it possible to compromise the password of a Group Managed Service Account’s (gMSA) in a domain if high privileges are obtained in the same domain.

Combining the Configuration NC replication attack research and the GoldenGMSA tool we found that another child to parent attack is possible.

As demonstrated in part 3 (SID filtering explained), the Enterprise Domain Controllers SID, TDO SIDs, and NeverFilter SIDs were exempted from domain trust SID filtering. This blog post aims to identify rights granted to any exceptions, which can result in attacks from a child to a parent domain, thereby bypassing SID filtering as a security boundary. Two attacks, which we believe are novel, will be described: Keys container trust attack and DNS trust attack, for each we provide possible mitigations and detections, but as the conclusion says: we deem our suggested mitigations lowers the risk by such a small amount that the risk of mitigations breaking functionality is not justified. Additionally, we will describe an attack unrelated to the SID filtering exceptions: GPO on site attack.

This blog post is part three of a seven-part series.

This blog post will explain SID filtering for an intra-forest AD trust and demonstrate how SID filtering prevents the attacks shown in part 2: Known AD attacks – from child to parent. It’s not necessary to read part 2 first, but it is recommended.

This blogpost will demonstrate how an attacker with Domain Admin access in child domain can escalate to Enterprise Admins using known attacks. Various misconfigurations and vulnerabilities also make it possible to accomplish this escalation, the methods covered in this blogpost are all based on Kerberos weaknesses which work in a default AD environment and are rarely prevented.

Can SID filtering create a security boundary between domains?

While researching this question, inspired by a comment on the Active Directory (AD) trust blogpost by harmj0y, which asked if enabling SID filtering on a child-parent trust (QuarantinedWithinForest) would prevent the SID history/ExtraSids attack from compromising the parent AD domain, @Martin, @Jonas, and @Tobias kept finding interesting new things.

What they expected to be a short blog post turned into a seven-part series, as they explored how to exploit Kerberos flaws to become Enterprise Admin, prevention against publicly known attacks, and finally, some novel bypasses to the prevention.

In part one of the series, they outline the underlying Kerberos authentication mechanisms to set the context for the attacks, defences, and research in the rest of the series. Read it here.