> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/10.-cross-forest-tickets.md).

# 10. Cross Forest Tickets

**The problem Kerberos solves here:** you have a TGT from `domain.htb`, but you need to authenticate to a service in `sub.htb`. You can't use your `domain.htb` TGT directly against `sub.htb`'s KDC — Kerberos requires an explicit, multi-step **referral** process across a trust boundary.

## The Three-Hop Pattern

1. **Home-realm TGT** — a normal TGT from your own domain's KDC.
2. **Referral ticket** — request a special "ticket" for `krbtgt/OTHERDOMAIN.HTB` from *your own* KDC. This isn't a ticket to a real service — it's effectively your home KDC vouching for you to the other domain's KDC.
3. **Target-realm service ticket** — present that referral ticket to the *other* domain's KDC, requesting a normal service ticket (`ldap/dc2.sub.htb`, `cifs/dc2.sub.htb`, etc.) exactly as if you were a native user there.

## Worked Example

```bash
# Hop 1: normal TGT in domain.htb
getTGT.py domain.htb/jane.doe:'Password123' -dc-ip 10.10.10.5
export KRB5CCNAME=jane.doe.ccache

# Hop 2: referral ticket for sub.htb's krbtgt
getST.py -spn 'krbtgt/SUB.HTB' -dc-ip 10.10.10.5 -k -no-pass domain.htb/jane.doe
export KRB5CCNAME='jane.doe@krbtgt_SUB.HTB@DOMAIN.HTB.ccache'

# Hop 3: use the referral to get a real service ticket inside sub.htb
getST.py -spn 'ldap/dc2.sub.htb' -dc-ip 192.168.2.2 -k -no-pass sub.htb/jane.doe
export KRB5CCNAME='jane.doe@ldap_dc2.sub.htb@SUB.HTB.ccache'
```

## Common Pitfall

Skipping a hop, or reusing a stale ticket from an earlier hop, produces Kerberos errors (`KDC_ERR_S_PRINCIPAL_UNKNOWN`, `KRB_AP_ERR_TKT_EXPIRED`) that *look* like a credentials problem but are actually just "wrong ticket for this stage of the chain." Always refresh from Hop 1 whenever your privileges change (e.g. after a new group membership takes effect) — an old ticket won't reflect the update.

## This Same Pattern Runs in Both Directions

Once you're operating as an account native to `sub.htb`, and need to reach back into `domain.htb` (e.g. to abuse a certificate template there), you repeat the exact same three hops — just with the realms swapped.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/10.-cross-forest-tickets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.