Enumerate and audit Active Directory forest trust relationships using Impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment. Use when red-teaming multi-forest AD environments or auditing forest trusts for cross-forest privilege escalation and trust ticket forgery exposure.
Start a fresh conversation. Replace the highlighted placeholders.
Use performing-active-directory-forest-trust-attack to perform an authorized read-only forest-trust security audit of [authorized AD scope] using [read-access credentials] and [domain controller targets], returning trust-risk findings without exploiting or modifying systems.
Required inputs
[authorized AD scope]
[read-access credentials]
[domain controller targets]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: performing-active-directory-forest-trust-attackdescription: Enumerate and audit Active Directory forest trust relationships using Impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment. Use when red-teaming multi-forest AD environments or auditing forest trusts for cross-forest privilege escalation and trust ticket forgery exposure.domain: cybersecuritysubdomain: red-teamtags: - active-directory- forest-trust- impacket- SID-filtering- kerberos- red-team- trust-enumerationversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - ID.RA-01- GV.OV-02- DE.AE-07mitre_attack: - T1595- T1190- T1059- T1078- T1558.003
Performing Active Directory Forest Trust Attack
Overview
Active Directory forest trusts enable authentication across organizational boundaries but introduce attack surface if misconfigured. This skill uses impacket to enumerate trust relationships, analyze SID filtering configuration, detect SID history abuse vectors, perform cross-forest SID lookups via LSA/LSAT RPC calls, and assess inter-realm Kerberos ticket configurations for trust ticket forgery risks.
When to Use
When conducting security assessments that involve performing active directory forest trust attack
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Python 3.9+ with impacket, ldap3
Domain credentials with read access to AD trust objects
Network access to Domain Controllers (ports 389, 445, 88)
Authorized penetration testing engagement or lab environment
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Steps
Enumerate forest trust relationships via LDAP trusted domain objects
Query trust attributes and SID filtering status for each trust
Perform SID lookups across trust boundaries using LsarLookupNames3
Enumerate foreign security principals in trusted domains
Check for SID history on cross-forest accounts
Assess trust direction and transitivity for lateral movement paths
Generate trust security audit report with risk findings
Expected Output
JSON report listing all trust relationships, SID filtering status, foreign principals, trust direction/transitivity, and risk assessment
Cross-forest attack path analysis with remediation recommendations
performing-active-directory-forest-trust-attack by mukul975 · The Skill Leaderboard