CVE-2020-0665 (Forest Trust Transitivity Bypass)

A forest trust transitivity bypass (patched Feb 2020). An attacker who fully controls Forest A can inject a local SAM SID from the trusting Forest B (e.g. a Forest B member server’s local-admin RID-500 SID) into Forest A’s set of “trusted” SIDs, so that a forged Kerberos ticket carrying that local SID is accepted on a Forest B member server — a cross-forest privilege escalation that does not require enablesidhistory.

The mechanics (per ad-trust-attacks)

1. Forest B’s DCs periodically refresh their allowed cross-forest SIDs from msDS-TrustForestTrustInfo via the NetrGetForestTrustInformation RPC.
2. The attacker (owning Forest A) hooks lsass.exe’s processing of that RPC call (Frida + RtlLengthSid) to insert a Forest B local-SAM SID into the trusted-SID set.
3. After Forest B’s ~24h refresh, a forged ticket (a Golden Ticket-style forgery) containing that local-admin SID is accepted on the Forest B member server.

Scope / constraints

• Only member servers / workstations are affected (a DC’s local SAM is only active in DSRM — see ad-persistence).
• Requires full control of the source (Forest A) to hook its LSASS.
• Patched Feb 2020 — post-patch hosts reject Kerberos service tickets carrying SIDs local to their own domain (Event ID 4675).

Why it matters

• It’s a cross-forest pivot that beats the usual “need SID history” constraint — the trust boundary that’s supposed to be the forest’s real defense.
• It’s fundamentally a forged-ticket technique (same mechanics as golden-silver-tickets) applied across a trust boundary with a different SID-validation context.
• Pairs with a krbtgt compromise in Forest A + a legacy trust into Forest B — the classic “second forest” dominance play.

Detection / mitigation

• Event 4675 — filtered/local-SID rejections (post-patch tell).
• Monitor NetrGetForestTrustInformation calls and msDS-TrustForestTrustInfo changes.
• Patch (Feb 2020) — the primary fix.
• Audit trusts for SID-history / TREAT_AS_EXTERNAL (ad-trust-attacks).

Links

• ad-trust-attacks — the forest-boundary / SID-filtering concept this CVE bypasses
• ad-forest-trust-attacks — the full source detail
• golden-silver-tickets — the forged-ticket mechanics it reuses
• krbtgt — the Forest A secret that makes the pivot possible
• sid-history — the related (but distinct) SID-injection primitive
• path-cross-forest-trust-pivot — the cross-forest attack path note

References

• ad-trust-attacks (this wiki)
• MS-NRPR / NetrGetForestTrustInformation
• Public PoC: AD Forest Trust Transitivity Bypass