ExtraSid Diamond Ticket: Patching Impacket for Fully Patched KDCs
So, you want to escalate from child domain krbtgt to forest root domain krbtgt or simply to forest root. You are in a hardened domain and you fight 2 things, a patched KDC and no RC4 intra-forest. Unfortunately, stock ticketer.py doesn't fix neither.