Cross-Forest Kerberoasting and Foreign Group Membership: Attacking Across Trust Boundaries

#The Other Forest Has Weaker Passwords. And You Can Reach It.#link

INLANEFREIGHT.LOCAL has a bidirectional forest trust with FREIGHTLOGISTICS.LOCAL. Bidirectional means users in either forest can authenticate to resources in the other. And if Kerberos authentication flows across the trust, so does Kerberoasting. You can request TGS tickets for SPN accounts in the partner forest using your current domain credentials.

I've compromised the "secure" parent domain by attacking the "forgotten" subsidiary domain across a forest trust. The parent had 20-character random service account passwords. The subsidiary had Sql2019! on their MSSQL service account. Same company. Same admins. Different security maturity. The trust gave me a bridge from the weak domain to the strong one.

How do you Kerberoast across a forest trust?

One command. Different domain specified via /domain:. The mssqlsvc account in FREIGHTLOGISTICS.LOCAL is a Domain Admin there. Crack this hash and you own the second forest. The trust direction (bidirectional) is what makes this possible. If it were one-way inbound only, you couldn't authenticate outward.

What about foreign group membership across trusts?

Forest trusts are attack surface multipliers. Every trust is a potential bridge from a weaker domain to a stronger one. Always enumerate trusts. Always check for cross-forest SPN accounts. Always look for foreign group membership. The client might not even remember the trust exists. That's when it's most dangerous.