LDAP

A lot of information on an AD domain can be obtained through LDAP. Most of the information can only be obtained with an authenticated bind but metadata (naming contexts, dns server name, domain functional level) can be obtainable anonymously, even with anonymous binding disabled.

ldapsearch-ad
windapsearch
ldapdomaindump
ldapsearch-ad

The ldapsearch-ad Python script can also be used to enumerate essential information like domain admins that have their password set to never expire, default password policies and the ones found in GPOs, trusts, kerberoastable accounts, and so on.

ldapsearch-ad --server $DOMAIN_CONTROLLER --domain $DOMAIN --username $USER --password $PASSWORD --type all
windapsearch

The windapsearch script (Go (preferred) or Python) can be used to enumerate basic but useful information.

# enumerate users (authenticated bind)
windapsearch -d $DOMAIN -u $USER -p $PASSWORD --dc $DomainController --module users
# enumerate users (anonymous bind)
windapsearch --dc $DomainController --module users
# obtain metadata (anonymous bind)
windapsearch --dc $DomainController --module metadata
ldapdomaindump

ldapdomaindump is an Active Directory information dumper via LDAP, outputting information in human-readable HTML files.

ldapdomaindump --user 'DOMAIN\USER' --password $PASSWORD --outdir ldapdomaindump $DOMAIN_CONTROLLER

LDAP anonymous binding is usually disabled but it's worth checking. It could be handy to list the users and test for ASREProasting (since this attack needs no authentication).

Automation and scripting

  • A more advanced LDAP enumeration can be carried out with BloodHound (see this).

  • The enum4linux tool can also be used, among other things, for LDAP recon (see this page).