Are one-way trusts really one way? @drm sums up how the TDO password lets you turn a one-way AD forest trust into bidirectional access, and releases a new tool to remotely extract these secrets.

https://offsec.almond.consulting/trust-no-one_are-one-way-trusts-really-one-way.html