Trust Attacks Commands

8 Trust Attacks commands from the Privilege Escalation category, each with its placeholders, supported authentication methods and upstream references.

Tools covered: impacket-goldenPac, impacket-lookupsid, impacket-raiseChild, impacket-ticketer, ldapsearch, nxc

• Impacket goldenPac (MS14-068) Exploit MS14-068 Kerberos privilege escalation to obtain Domain Admin via forged PAC
• Impacket LookupSID Enumerate domain SIDs and discover trust relationships via SID brute-forcing
• Impacket raiseChild Escalate from child domain DA to forest root DA via inter-realm Kerberos trust
• Inter-Realm Golden Ticket Forge a cross-domain Golden Ticket to escalate from child to parent domain
• LDAPSearch Shadow Principals (PAM Trust) Enumerate msDS-ShadowPrincipal objects to identify PAM trust shadow principals
• NetExec LDAP Raise Child Escalate from child domain DA to forest root DA via inter-realm Kerberos trust abuse
• NetExec SMB NoPAC Check for and exploit the NoPAC (CVE-2021-42278/42287) Kerberos privilege escalation vulnerability
• NetExec SMB Zerologon Check for Zerologon (CVE-2020-1472) vulnerability — resets DC computer account password to empty