I85PREP
⌘ K
HTB CAPE study materials
HTB CAPE study resources

HTB CAPE: Domain and Forest Compromise (Kerberos, ACL Abuse, Trusts)

HTB CAPE · Work through your exam, one topic at a time.

All guide sections

Domain and Forest Compromise (Kerberos, ACL Abuse, Trusts)

What this domain tests

Domain and Forest Compromise tests full takeover through Kerberos ticket abuse, ACL escalation, and trust attacks. The exam expects you to distinguish domain compromise from forest compromise and to prove your access.

Core rules and concepts

  • A Golden Ticket requires the krbtgt hash; a Silver Ticket requires a service account hash; DCSync requires Replicating Directory Changes rights.
  • ACL abuse paths include WriteDACL to grant DCSync, GenericAll to reset a Domain Admin password, and WriteOwner to take ownership before changing permissions.
  • Trusts: SID history injection requires the trust key and SID filtering disabled; ExtraSids requires a Kerberos ticket carrying a high-privilege SID.
  • Parent-child trusts differ from external and forest trusts; direction and transitivity matter.

Worked example

BloodHound shows your user has WriteDACL on the domain object. Grant yourself DCSync with Add-DomainObjectAcl -TargetIdentity 'DC=domain,DC=local' -PrincipalIdentity attacker -Rights DCSync, then run secretsdump -just-dc. Reasoning: you escalate through an ACL, not by cracking krbtgt. After DCSync, you can build a Golden Ticket or extract the trust key for forest movement.

Traps that cost marks

  • Assuming SID filtering is disabled on an external trust.
  • Rotating krbtgt after creating a Golden Ticket and invalidating your own access.
  • Confusing a parent-child trust with a forest trust.
  • Forgetting that DCSync rights can be granted directly or through group membership.
  • Requesting a ticket with the wrong encryption type or SID.