skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

trust-attacks

Enumerate and exploit Active Directory trust relationships for cross-domain privilege escalation.

253|37|Updated Feb 22, 2026
Search Tags:#privilege escalation#kerberos#active directory#trust relationships#sid history#forest trust
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill trust-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: trust-attacks
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/trust-attacks
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill trust-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit weaknesses in Active Directory trust relationships to gain elevated privileges across domains and forests.

Core Features & Use Cases

  • Trust Enumeration: Discover and analyze various types of AD trusts (forest, external, parent-child).
  • SID History Injection: Forge tickets to impersonate users in trusted domains, bypassing security boundaries.
  • Inter-Realm TGT Forging: Leverage trust account keys to authenticate into other domains.
  • PAM Trust Exploitation: Exploit shadow principals in bastion forests for broad access.
  • Use Case: After identifying a forest trust with SID filtering disabled, use this Skill to forge a golden ticket with the Enterprise Admins SID of the parent forest, granting immediate high-level access.

Quick Start

Use the trust-attacks skill to enumerate all trust relationships in the current Active Directory environment.

Frequently Asked Questions about trust-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Active Directory trust relationships for privilege escalation?▼

Active Directory trust exploitation involves discovering trust types, forging inter-realm TGT tickets, and injecting SID history to bypass security boundaries for cross-domain and cross-forest privilege escalation.

What is SID history injection and how does it work in forest trusts?▼

SID history injection forges tickets to impersonate trusted domain users, bypassing security boundaries. It grants elevated privileges when SID filtering is disabled in forest trust configurations.

How do I forge an inter-realm TGT using trust account keys?▼

Inter-realm TGT forging leverages extracted trust account keys to authenticate across domain boundaries, allowing attackers to request tickets and access resources in trusted Active Directory domains.

Do I need Mimikatz and Rubeus to exploit cross-forest trust relationships?▼

Yes, exploiting cross-forest trust relationships requires tools like Mimikatz, Rubeus, and Impacket for execution, ticket forging, and analysis of Active Directory trust properties.

How does PAM trust exploitation work in Active Directory bastion forests?▼

PAM trust exploitation targets shadow principals in bastion forests to gain broad administrative access. It abuses Privileged Access Management configurations to escalate privileges across established trusts.

What is the best way to enumerate AD trust types for penetration testing?▼

Enumerating AD trust types involves discovering and analyzing forest, external, and parent-child relationships to identify weaknesses like disabled SID filtering for cross-domain escalation opportunities.

Related Skills

Explore More Software Engineering Skills→
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

kerberos-delegation

Exploit Kerberos delegation misconfigurations in Active Directory for privilege escalation.

Official
Advanced
AeonDaveAeonDave
15

crackmapexec

Automate Active Directory credential spraying, enumeration, and remote command execution over SMB and WinRM.

Community
Advanced
utsavthakurutsavthakur

active-directory-kerberos-attacks

Execute multi-step Kerberos attacks against Active Directory authentication.

Community
Advanced