Skip to main content

​
Service Detection

nmap -sV -sC -p 389,636 TARGET

​
Anonymous Bind

ldapsearch -x -H ldap://TARGET -s base namingcontexts

​
Dump Everything

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local"

​
With Credentials

ldapsearch -x -H ldap://TARGET -D "[email protected]" -w "password" -b "DC=domain,DC=local"

​
Enumerate Users

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName description memberOf

​
Users with Descriptions (May Contain Passwords)

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(description=*)" sAMAccountName description

​
Enumerate Groups

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(objectClass=group)" cn member

​
Domain Admins

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(&(objectClass=group)(cn=Domain Admins))" member

​
Password Policy

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(objectClass=domain)" minPwdLength maxPwdAge lockoutThreshold

​
Kerberoastable Accounts

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName

​
AS-REP Roastable Accounts

ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" sAMAccountName

​
Tools

​
ldapdomaindump

ldapdomaindump -u 'domain.local\user' -p 'password' TARGET
Outputs HTML files with users, groups, computers, policies.

​
windapsearch

python3 windapsearch.py -d domain.local --dc-ip TARGET -u user -p password --da --users --groups

​
CrackMapExec

crackmapexec ldap TARGET -u user -p password --users
crackmapexec ldap TARGET -u user -p password --groups
crackmapexec ldap TARGET -u user -p password --password-not-required

​
NSE Scripts

nmap -p 389 --script ldap-rootdse TARGET
nmap -p 389 --script ldap-search TARGET
nmap -p 389 --script ldap-brute TARGET

​
Quick Reference

CheckCommand
Anonymous bindldapsearch -x -H ldap://TARGET -s base namingcontexts
Dump allldapsearch -x -H ldap://TARGET -b "DC=domain,DC=local"
UsersAdd filter (objectClass=user)
KerberoastableFilter (servicePrincipalName=*)
Full dumpldapdomaindump -u user -p pass TARGET