Understanding Lively Listing trusts inside domains and forests utilizing PowerView
Area Trusts are relationships that permit communications between domains inside one forest or a number of forests. In an Lively Listing surroundings, these relationships permit customers and teams to share assets throughout the group’s networks.
Some trusts are generated mechanically, like Dad or mum-Youngster and Tree-Root trusts, permitting customers of the identical forest to share assets collectively. Whereas others, like Exterior and Realm trusts, have to be established manually to entry the supposed assets, often positioned on a distinct forest. Every belief kind can both have One-way or Two-Method instructions.
This publish will focus on Lively Listing area trusts and their enumeration utilizing the PowerView script. The demonstration steps might be on the Pentester Academy Lively Listing Lab by Nikhil Mittal related to the CRTP course.
- One-Method belief permits the assets inside one area/forest to be accessible to solely specified trusted domains/forests. That belief doesn’t reciprocate; it is just one-way. It’s like, “I belief you, however you don’t belief me.”
Let’s take a look at the diagram beneath; Area 2 has a one-way belief to Area 1. Meaning all assets inside Area 1 are permitted to entry the assets of Area 2 however not vice versa (area 2 can’t entry area 1) 🚫.
The arrow factors in the direction of who can entry the assets with the established belief.
- Two_Way belief permits sharing assets in each instructions, like in Determine 2. “We belief one another” ✔️.
Area 1 shares assets each methods with Area 2,and vice versa.
Transitive Belief:
The kind of belief prolonged outdoors the area’s boundary to facilitate sharing assets inside different domains in the identical forest. Some trusts are mechanically generated when created, such because the Dad or mum-Youngster, and Tree-Root trusts with two-way path.
Others are created manually, like with the Forest and Shortcut trusts. These trusts can both be one-way or two-ways.
Within the beneath diagram, we see that “Forest 1” has a transitive 2-way path to “Forest 2”, which signifies that all domains inside “Forest 1” are accessible to “Forest 2” and the opposite approach round. The identical applies contained in the forests, on the tree-root and parent-child ranges.
Non-Transitive Trusts
The kind of belief that can not be prolonged. It’s created manually as a one-way belief to entry assets residing on one other area in an untrusted forest. Exterior and Realm (non-windows AD domains) trusts are examples of non-transitive trusts.
The diagram beneath exhibits one-way exterior belief between “Area 2” in “Forest 2” and “Forest 1”. The arrowhead signifies the entry path. On this case, Forest 1 customers have entry to Area 2 in Forest 2 solely. Area 2 in Forest 2 has NO entry to Forest 1.
Now that we perceive the varieties of trusts within the Lively Listing world, let’s begin enumerating them throughout the given surroundings.
◼️Get Forest Particulars
First, we begin with getting details about the present forest utilizing the Get-NetForest cmdlet alone or utilizing the Forest parameter to specify forest title.
Get-NetForest
Get-NetForest –Forest Forest Identify
The command returns the present forest title “moneycorp.native” and the obtainable domains throughout the forest (moneycorp.native, dollarcorp.moneycorp.native, and us.dollarcorp.moneycorp.native).
◼️ Map Area Trusts
Run the Get-NetDomainTrust cmdlet to get the obtainable trusts throughout the present or every other trusted area in the identical forest or exterior. So long as now we have the trusts established, we are able to enumerate them.
Get-NetDomainTrust
Get-NetDomainTrust –Area [Domain Name]
The above screenshot exhibits that the present area “dollarcorp.moneycorp.native” has 3 belief relationships:
- Transitive, 2-way belief with its Forest “moneycorp.native.”
- Transitive, 2-way belief with its baby area “us.dollarcorp.moneycorp.native.”
- and an Exterior 2-way belief with one other Forest known as “eurocorp.native.”
◼️ Get Domains Construction
To get the construction and hierarchy of the domains throughout the present or a specified forest, we are able to run the Get-NetDomainForest cmdlet alone or with the Forest parameter.
Get-NetForestDomain
Get-NetForestDomain -Forest [Forest Name]
The above outcomes present that inside our forest, “moneycorp.native” is the foundation area “moneycorp.native” as a result of it doesn’t have any mother or father domains, and its baby area is “dollarcorp.moneycorp.native”.
Additionally, the “us.dollarcorp.moneycorp.native” area is the kid of the “dollarcorp.moneycorp.native” area.
moneycorp.native > dollarcorp.moneycorp.native > us.dollarcorp.moneycorp.native
This diagram represents the construction of the moneycorp.native forest.
That’s all for right now; we discovered about Lively Listing trusts and map these trusts with the obtainable domains inside a given forest utilizing the PowerView enumeration script.
Thanks for studying !!
🔔 I included the AD-module instructions within the Notion bucket as an alternative choice to PowerView. All the used instructions may be discovered at R3d-Buck3T — (Lively Listing — Trusts Enumeration with PowerView and AD-Module)
