A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Domain Admin in LOGISTICS.INLANEFREIGHT.LOCAL does not automatically make you Domain Admin in the parent INLANEFREIGHT.LOCAL. But it gets you there in about three commands. The ExtraSids attack exploits the fact that SID Filtering is not enforced within a forest. The sidHistory attribute, designed for migration scenarios, becomes your escalation vector.
The concept: you create a Golden Ticket in the child domain, but you inject the Enterprise Admins SID from the parent domain into the ticket's ExtraSids field. When you present this ticket to the parent domain's DC, it sees the Enterprise Admins SID in the PAC and grants you Enterprise Admin access. No group membership required. Just a forged ticket with the right SID.
Full filesystem access to the parent Domain Controller. The user 'hacker' doesn't exist. The Golden Ticket is valid for 10 years. And the ExtraSids field containing the Enterprise Admins SID is what grants access across the trust boundary.
Child domain compromised means parent domain compromised. Every time. Unless SID Filtering has been explicitly enabled on the intra-forest trust (rare, breaks migrations). This is why child domain security matters as much as parent domain security. A soft child domain is a backdoor into the entire forest.
Finish the lesson once you have worked through the material. This awards ★ 50 XP.