Abusing trust for lateral movement

In this section, we are going to discuss various ways to abuse forest trust for lateral movement. Movement from the child to the parent domain inside the forest is covered in Chapter 6/

We will start by covering the necessary theory and then apply it to practice. As stated by Microsoft, a forest is a security boundary and consists of one or more AD domains that share a common schema, configuration, and global catalog. The schema defines objects within the forest, and the global catalog contains a partial attribute set of each object in the forest domains. There are six types of trust relationships; we will focus our attention on the External and Forest types. To understand more about security boundaries, we need to discuss the Security Identifier (SID), the SID history attribute, and SID filtering.

SID is a unique identifier assigned to each security principal in the domain. SID filtering is a mechanism that filters out SIDs from other domains...