Home
Most stakeholders treat a domain as a security boundary. It is not. The forest is. This walkthrough traces a single attack chain that started with domain-admin access already held in a child domain and ended with every credential in the environment dumped from the forest root. The pivot that made it possible was one forged Kerberos ticket and one missing control.
What is a golden ticket with SID history?
A golden ticket is a Kerberos ticket-granting ticket forged offline using a domain’s stolen krbtgt account hash, giving an attacker the power to impersonate any account in that domain. SID history injection adds a second domain’s privileged group SID as an extra-SID inside the ticket, so the ticket claims rights in a domain the attacker never touched.
The technique matters because it crosses a trust boundary. A golden ticket alone stays inside one domain. Add the forest root’s Enterprise Admins SID as an extra-SID, and the forged ticket becomes a key to the whole forest, provided the trust does not filter it out.
The attack chain at a glance
Classification: Critical. Attack type: cross-domain SID history injection. Target: KINGSLANDING (192.168.56.10). Forest: sevenkingdoms.local. The chain runs in six steps, from a foothold in the child domain to full control of the forest root.
Teal marks actions inside the compromised child domain. Amber marks the pivotal forge step. Red marks the trust weakness enabling the crossing. Purple marks the forest root falling.
Step-by-step narrative
- Compromise the child domain. The team already held domain-admin-equivalent access in north.sevenkingdoms.local, reachable through other findings in the engagement (the AS-REP roast of brandon.stark into STARK’s GenericAll over Domain Admins, or the cleartext samwell.tarly credential). This is the starting position, not the achievement.
- DCSync WINTERFELL. With replication rights, the team pulled the child domain’s krbtgt account hash straight off its domain controller. That hash is the master key for forging Kerberos tickets in that domain. Kerberos credential material is a recurring theme in Active Directory attacks, as our breakdown of how attackers abuse keytab files shows.
- Forge the golden ticket with an injected SID. The pivotal move. Using the stolen krbtgt hash, the team forged a golden ticket for a north domain account but injected the forest root’s Enterprise Admins group SID (ending in -519) as an extra-SID. The ticket now claims membership in a group that lives in a domain the attacker never touched.
- Cross the trust boundary. Because SID filtering (trust quarantine) was not enforced on the inter-domain trust, the forest root DC honored the injected SID instead of stripping it. This single missing control is what turns a child-domain compromise into a forest compromise.
- DCSync KINGSLANDING. Presenting the forged ticket to the forest root DC, the team ran DCSync against it and dumped the root domain’s entire NTDS database, including the root Administrator and krbtgt hashes.
- Full forest compromise. Game over. The team can now forge tickets for any account in any domain in the forest. Recovery requires rotating krbtgt twice in both domains. Until then, persistence is total.
Why this is the finding to demonstrate
It is the complete kill chain to the top prize. It emphasizes the “domain is not a boundary” lesson that defenders routinely miss. And the root cause is one concrete, defensible fix, not a sprawl of misconfigurations. A finding like this changes how a security program thinks about trust relationships, not just how it patches a single host.
Root cause and remediation
Root cause: SID filtering (trust quarantine) was not enforced on the inter-domain trust, allowing a forged extra-SID from the child domain to be honored by the forest root.
Primary fix: enable SID filtering on the trust, then rotate krbtgt twice in both domains.
netdom trust /d:sevenkingdoms.local north.sevenkingdoms.local /quarantine:yesFollow the krbtgt rotations with tiered administration so forest-root credentials are isolated from child-domain admins. That last step is what stops the same chain from reappearing the moment a child domain is compromised again. For background on the underlying identity attack techniques, see the MITRE ATT&CK entries for Golden Ticket (T1558.001) and SID-History Injection (T1134.005).
Why isolated findings miss chains like this
Each step in this chain, viewed alone, looks survivable. Replication rights on a child DC. A forgeable ticket. A trust without SID filtering. Scored one at a time, none of them screams forest takeover. The risk lives in the sequence, and a program that tests assets in isolation never sees the sequence.
This is the gap between finding vulnerabilities and proving attack paths. Chaining findings across domains and trust boundaries is exactly what an adversary does and exactly what most annual, scanner-based programs do not. FireCompass runs agentic AI web and API pentests that discover the surface, exploit findings with a working proof of concept, then chain them into multi-stage paths, including lateral movement into Active Directory. Every finding ships with evidence, which keeps false positives under 2%. The continuous autonomous pentesting workflow shows how that discover, pentest, chain, and retest loop runs on a weekly cadence instead of once a year.
Frequently asked questions
Is a domain a security boundary in Active Directory?
No. In Active Directory, the forest is the security boundary, not the domain. A trust relationship between domains can allow a compromise in one domain to reach another if controls like SID filtering are not enforced.
What is SID filtering and why does it matter?
SID filtering, also called trust quarantine, strips foreign SIDs from authentication data crossing an inter-domain trust. When it is not enforced, a forged extra-SID from a compromised child domain can be honored by the forest root, which is the exact weakness this chain exploited.
How do you recover from a golden ticket attack?
Recovery requires rotating the krbtgt account password twice in every affected domain, because a single rotation leaves the previous key valid. In a cross-domain compromise like this one, that means rotating krbtgt twice in both the child domain and the forest root, then enforcing SID filtering and tiered administration.
Can a scanner detect an attack chain like this?
Not reliably. A scanner flags individual weaknesses in isolation and reports high false positive rates. The risk here lives in the sequence of steps across a trust boundary, which requires exploiting and chaining findings the way an attacker would, then validating impact with a proof of concept.
What is the difference between a golden ticket and a golden ticket with SID history?
A standard golden ticket grants attacker control within a single domain. Adding SID history injects a privileged group SID from a second domain as an extra-SID, so the forged ticket claims rights in a domain the attacker never directly compromised. That is what extends the attack from one domain to the entire forest.
