I want to learn How can we get the info of other domain while they have in trust?

Forex:- a.com trusts b.com and b.com trusts a.com and I compromised a.com then Is it possible for me to retrieve info about b.com from a.com?

If it's possible then What are the key requirements?

I tried Get-NetGroupMember "Domain Admins" -Domain Other.domain but I only get the members of local domain.

Note:- I am using PowerView for it.


If the domain trust is in place, authenticated users in a.com can query AD information about b.com, such as membership in the Domain Admins group. This VBScript demonstrates it:

' VBScript group membership program.
' ----------------------------------------------------------------------
' Portions from sample code provided by Richard L. Mueller
' Hilltop Lab web site - http://www.rlmueller.net

Option Explicit 
Const adUseClient = 3

Dim oConnection, oCommand, sQuery, oResults 
Dim sAdsPath, oGroup 

Set oConnection = CreateObject("ADODB.Connection") 
Set oCommand = CreateObject("ADODB.Command") 
oConnection.Provider = "ADsDSOObject" 
oConnection.Open "Active Directory Provider" 
Set oCommand.ActiveConnection = oConnection 

sQuery = "<LDAP://b.com>;(&(ObjectCategory=group)(cn=Domain Admins));DistinguishedName;subtree" 

oCommand.CommandText = sQuery 
oCommand.Properties("Page Size") = 1000 
oCommand.Properties("Timeout") = 30 
oCommand.Properties("Cache Results") = False 

Set oResults = CreateObject("ADODB.Recordset")
oResults.CursorLocation = adUseClient
oResults.Sort = "distinguishedname"
Set oResults = oCommand.Execute 

If oResults.EOF Then 
  Wscript.Echo "Not found" 
End If 

Do Until oResults.EOF 
  sAdsPath = oResults.Fields("DistinguishedName") 
  Set oGroup = GetObject("LDAP://" & sAdsPath) 
  Wscript.Echo oGroup.sAMAccountName 
  Call GetMembers(oGroup,1) 

' Clean up.
If (IsObject(oConnection) = True) Then
    Set oCommand = Nothing
    Set oConnection = Nothing
End If

Sub GetMembers(oObject,n) 
  Dim oMember
  For Each oMember In oObject.Members 
    Wscript.Echo "Member: " & oMember.cn
End Sub 
  • Hi, that's really very difficult to understand it. Actually, I am using Powerview tool for that, so can you relate your answer with that. – janu agrawal Jan 3 at 15:22
  • You asked if it is possible -- I answered that it is. You asked about any requirements -- I answered that authenticated users can query the other domain. As for PowerView, I'm not familiar with it. The first two hits are window blinds and an Excel visualization tool. I don't think either of those are what you are asking about. The next hits refer to PowerShellMafia and PowerSploit. Those don't sound like things I'm comfortable helping with. It's too close to asking about "unauthorized use or misuse of IT systems", which is expressly discouraged at serverfault.com/help/on-topic. – Doug Deden Jan 3 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.