PAM Trust Abuse

Abuses an existing PAM/PIM forest trust by adding an attacker-controlled bastion-forest account to an existing shadow security principal whose msDS-ShadowPrincipalSid maps to a privileged group in the managed forest. That membership can give the bastion account cross-forest privileges when it authenticates to managed-forest resources. This procedure covers the shadow-principal membership path only; SID-History injection is a separate alternative and is not included in these steps. It requires the existing trust and mapping, plus effective permission to write the shadow principal object's member attribute.