I'm pen testing the page (IdpInitiatedSignOn.aspx) of a web app which uses an SSO mechanism (Active Directoy Federated Services). The username field requires a domain (e.g. company) to preface the username (e.g. company\jdoe). If I instead use a domain of my choosing (e.g. attacker.com\jdoe), I receive a DNS SRV lookup for _kerberos._tcp.dc._msdcs.attacker.com. Is there any route for exploitation here? What would happen if I stood up a domain controller at _kerberos._tcp.dc._msdcs.attacker.com?
Generally, it would attempt to gather a bit more information about the domain attacker.com, and determine whether the machine domain has a trust with the attacker.com domain. In this case there wont be a trust, so it would just fail the auth request.
This all happens at a very low level and ADFS isn't even involved yet, aside from ferrying the credentials from the web to the underlying Windows API.