Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Pentesting LDAP

ldapsearch Overview

  • LDAP is extremely hard for blue teams/IR to investigate as it is a critical function of AD

  • Log event ID 4648 will be generated from LDAP enumeration, which does not occur in normal AD LDAP traffic

  • It defaults to plain text authentication, so use TLS if you dont want to send creds in the clear

  • -ZZ forces the use of TLS

  • If you use -ZZ and port 636 is not open you will recieve an error message LDAP server is unavailable

  • Add TLS_REQCERT ALLOW to /etc/ldap/ldap.conf to disable certificate validation if you plan on using TLS LDAP

  • To use SSL with LDAP use -H option with ldaps://DC.domain.local

  • If SSL is not set up on the DC you will recieve the error Cant contact LDAP server

--help--
-D --> DN (username to bind with)
-w --> password
-p --> port (depricated option)
-b --> base location to begin your search
-s --> scope, defaults to subtree
-h --> name to append to ldap://
-H --> LDAP server with port specified (ldap://server.org:389)
-P --> protocol (2|3) default is 3
-Z --> start with TLS failover if unavailable
-ZZ --> force the use of TLS
-L --> restrict stdout to LDIFUL, -LL also disable comments
-LLL --> same as above + disable LDIF verion print if you want to export to LDAPAdmin.exe
-E pr=1000/noprompt --> perform up to 1000 requests w/o user prompt to continue

  • To use this tool you need at least the domain for DC --> whoami /fqdn / other enumeration

ldapsearch Generated Logs

ldapsearch

  • ldapsearch is a great utility to solicit information from a domain controller.

  • Start with attempting to see the scope

Anonymous LDAP with NetExec

Check whether anonymous LDAP bind is allowed and whether user descriptions leak credentials:

Useful output to look for:

If a password is exposed in description, validate the specific user only:

  • From there the next step is to get the DN

  • Note: The DN in the above query is DC=htb,DC=local, which you will need later

  • For this DN it is essentially the name of the domain you are targeting, in this example the target domain was htb.local.

  • At this point take your new found DN and use this query

  • Recommend directing this output to a file so you can grep

  • This command will produce a ton of output as it is all the ldap information that you can query

  • With your output in a text file, use these grep commands

Building an LDAP Query

  • once we have the above information we can run this ldap query to get all the the object class of person

  • For a more specific query where you just want the usernames you can use this query which is an alt method to our above command that utilized awk

  • Note if you see the above commands return something like this:

  • Most of those accounts are either machine accounts (those that end in $) or exchange accounts that do not allow login or user interaction.

  • For the above example the only account we would be interested in are:

ldapsearch with creds

Other Common Queries

  • Query all users collecting login infomation

  • kerberostable accounts

  • ASREP Roastable accounts

  • Pull all DCs in domain in addition to their Operating System

  • Dump all of AD *This is alot of output*

  • See the size of the domain

PreviousPentesting NFS
NextPentesting Finger

Last updated