Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
Service Detection
nmap -sV -sC -p 389,636 TARGET
Anonymous Bind
ldapsearch -x -H ldap://TARGET -s base namingcontexts
Dump Everything
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local"
With Credentials
ldapsearch -x -H ldap://TARGET -D "[email protected]" -w "password" -b "DC=domain,DC=local"
Enumerate Users
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName description memberOf
Users with Descriptions (May Contain Passwords)
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(description=*)" sAMAccountName description
Enumerate Groups
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(objectClass=group)" cn member
Domain Admins
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(&(objectClass=group)(cn=Domain Admins))" member
Password Policy
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(objectClass=domain)" minPwdLength maxPwdAge lockoutThreshold
Kerberoastable Accounts
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName
AS-REP Roastable Accounts
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" sAMAccountName
ldapdomaindump
ldapdomaindump -u 'domain.local\user' -p 'password' TARGET
windapsearch
python3 windapsearch.py -d domain.local --dc-ip TARGET -u user -p password --da --users --groups
CrackMapExec
crackmapexec ldap TARGET -u user -p password --users
crackmapexec ldap TARGET -u user -p password --groups
crackmapexec ldap TARGET -u user -p password --password-not-required
NSE Scripts
nmap -p 389 --script ldap-rootdse TARGET
nmap -p 389 --script ldap-search TARGET
nmap -p 389 --script ldap-brute TARGET
Quick Reference
| Check | Command |
|---|
| Anonymous bind | ldapsearch -x -H ldap://TARGET -s base namingcontexts |
| Dump all | ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" |
| Users | Add filter (objectClass=user) |
| Kerberoastable | Filter (servicePrincipalName=*) |
| Full dump | ldapdomaindump -u user -p pass TARGET |