Some organisations decide their normal domain is too exposed to keep the keys to the kingdom inside it. So they build a second, hardened forest, commonly referred to as "bastion" or "Red Forest", and move all their privileged admin accounts into it. The production forest then trusts the bastion forest to hand out that privileged access only when it's needed. Microsoft calls this Privileged Access Management, and the link between the two forests is a PAM trust.

It sounds safer, and on paper it is. The problem is the trust itself. It's built to let a bastion account become a Domain Admin in production on demand, and it turns off some of the protections that normally stop one forest injecting privileged access into another. That's exactly the behaviour we're going to abuse.

In this room you start with a foothold in the bastion forest. By the end, you'll be Domain Admin in the production forest, using two different techniques, without ever cracking a single production password.

One thing to be clear about up front. We're assuming the bastion forest is already compromised. How an attacker got that first foothold, whether it was phishing, a weak service account, or a misconfigured host, is outside of the scope and will not be covered. What matters for this room is what that foothold lets you do next. So you will start with a bastion admin account and get straight to abusing the trust.

Quick note before we start. This is the Microsoft PAM trust feature, not the Linux PAM (Pluggable Authentication Modules) you might have seen on a Unix box. Different thing entirely, same three letters.

Learning Objectives

• Understand what a PAM trust is and how it differs from an ordinary forest trust.
• Understand shadow security principals and how they grant production privilege to a bastion account.
• Enumerate the trust and the shadow principals to find your path in.
• Abuse a shadow principal to become Domain Admin in production.
• Forge a cross-forest ticket to reach the same access a second way.

Prerequisites

This room requires familiarity with Active Directory, Kerberos, and tools for credential-dumping and forging tickets. If you are not familiar with these, we recommend finishing the following rooms first:

• Attacking Kerberos
• Intro to Credential Harvesting
• Post-Exploitation Basics

Starting the Network

Use the information below to access the bastion box via RDP.

Before moving to the next task, click the green Start button under the network diagram. Give the network enough time to launch. You can connect to the network in two ways:

Option 1: Using the AttackBox

1. Click the Start AttackBox button at the top of this room. Once ready, your AttackBox will be available on a split-screen.
2. Launch a terminal window and run the following command to connect to the bastion box:

           user@tryhackme:~$ xfreerdp /v:10.10.10.20 /u:Administrator /d:bastion.thm /p:'Bast1onAdm1n123!@#' /dynamic-resolution +clipboard
        

Option 2: Over a VPN Connection

Alternatively, you can connect to the network via the VPN. To establish a VPN connection to this network follow the steps below.

1. Click the Download VPN Profile button below the network diagram.
2. In a Linux terminal, run the following command to connect to the VPN: sudo openvpn [your_configuration_file_name.ovpn]
3. Connect to the bastion box using the same xfreerdp command above.

Note: If using a Windows operating system, connect to the VPN using OpenVPN GUI, then simply connect to the bastion box using the Windows Remote Desktop client.