TLDR Tech / InfoSec
Trust no one: are one-way trusts really one way?
One-way Active Directory forest trusts are widely assumed to enforce a strict, unidirectional access model, but stored trust passwords quietly break that boundary. By extracting the trusted domain object (TDO) secret from the trusting forest, attackers with Domain Admin rights there can derive Kerberos keys for the TRUST_ACCOUNT in the trusted forest and log in as a valid domain user. The new tdo_dump.py tool automates remote extraction and key derivation via DRS replication calls, enabling LDAP recon, computer account creation, and Kerberoasting across what should be a one-way security barrier. For security teams, one-way “admin forest” designs no longer guarantee directionality. Hardening must assume compromise of a relying forest gives a foothold back into the management forest.
Read the full story