In larger enterprise environments multiple Active Directory forests are often in use to separate different environments or parts of the business. To enable integration between the different environments, forest trusts are set up. The goal of this trust is to allow users from the other forest to authenticate while maintaining the security boundary that an Active Directory forest offers. In 2018, this boundary was broken through default delegation settings and Windows features with unintended consequences. In 2019 the security boundary was once again established through a set of changes in Active Directory.
In this talk I’ll present a vulnerability in Kerberos and forest trusts that allowed attackers to break the trust once again. The talk will provide technical details on how Kerberos works over forest trusts and how the security boundary is normally enforced. Then the talk will discuss a flaw in how AD forest trusts operate and how this can be combined with a vulnerability in the Windows implementation of Kerberos to take over systems in a different forest (from a compromised trusted forest). The talk will be accompanied by a proof-of-concept and a demonstration of abusing the vulnerability. Expect a technical deep-dive into the complexities of the Kerberos protocol and a detailed analysis of what “trust” actually means.
