I am trying to identify specific attack vectors that occur due to domain/forest trust in Active Directory. Microsoft in their KB Articles Domain Trust, section "Considerations About Trusts" write that:
Domain administrators of any domain in the forest have the potential to take ownership and modify any information in the Configuration container of Active Directory. These changes will be available and replicate to all domain controllers in the forest.
But there is no specific description of how. In Security Considerations for Trusts, Microsoft list two more specific issues:
- Disabled SID Filtering here and here ( I understand you can disable it on external trusts?); and
- Enabled SID history.
Are there any other attacks that are specific to domain trusts? e.g. SMB Replay attack isn't specific to trust. Also, how does the writing to Configuration OU can be achieved and what can you write from the other domain?