LDAP
A lot of information on an AD domain can be obtained through LDAP. Most of the information can only be obtained with an authenticated bind but metadata (naming contexts, DNS server name, Domain Functional Level (DFL)) can be obtainable anonymously, even with anonymous binding disabled.
ldeep
ldapsearch
ldapsearch-ad
windapsearch
ldapdomaindump
ntlmrelayx
The ldeep (Python) tool can be used to enumerate essential information like delegations, gpo, groups, machines, pso, trusts, users, and so on.
# remotely dump information
ldeep ldap -u "$USER" -p "$PASSWORD" -d "$DOMAIN" -s ldap://"$DC_IP" all "ldeepdump/$DOMAIN"
# parse saved information (in this case, enumerate trusts)
ldeep cache -d "ldeepdump" -p "$DOMAIN" trusts
# list naming contexts
ldapsearch -h "$DC_IP" -x -s base namingcontexts
ldapsearch -H "ldap://$DC_IP" -x -s base namingcontexts
# enumerate info in a base (e.g. naming context = DC=DOMAIN,DC=LOCAL)
ldapsearch -h "$DC_IP" -x -b "DC=DOMAIN,DC=LOCAL"
ldapsearch -H "ldap://$TARGET" -x -b "DC=DOMAIN,DC=LOCAL"
The ldapsearch-ad Python script can also be used to enumerate essential information like domain admins that have their password set to never expire, default password policies and the ones found in GPOs, trusts, kerberoastable accounts, and so on.
ldapsearch-ad --type all --server $DOMAIN_CONTROLLER --domain $DOMAIN --username $USER --password $PASSWORD
The FFL (Forest Functional Level), DFL (Domain Functional Level), DCFL (Domain Controller Functionality Level) and naming contexts can be listed with the following command.
ldapsearch-ad --type info --server $DOMAIN_CONTROLLER --domain $DOMAIN --username $USER --password $PASSWORD
# enumerate users (authenticated bind)
windapsearch -d $DOMAIN -u $USER -p $PASSWORD --dc $DomainController --module users
# enumerate users (anonymous bind)
windapsearch --dc $DomainController --module users
# obtain metadata (anonymous bind)
windapsearch --dc $DomainController --module metadata
ldapdomaindump is an Active Directory information dumper via LDAP, outputting information in human-readable HTML files.
ldapdomaindump --user 'DOMAIN\USER' --password $PASSWORD --outdir ldapdomaindump $DOMAIN_CONTROLLER
With Impacket's ntlmrelayx (Python), it is possible to gather lots of information regarding the domain users and groups, the computers, ADCS, etc. through a NTLM authentication relayed within an LDAP session.
ntlmrelayx -t "ldap://domaincontroller" --dump-adcs --dump-laps --dump-gmsa
- show subnets listed in AD-SS (Active Directory Sites and Services)
- list the users description
# list PKIs/CAs
cme ldap "domain_controller" -d "domain" -u "user" -p "password" -M adcs
# list subnets referenced in AD-SS
cme ldap "domain_controller" -d "domain" -u "user" -p "password" -M subnets
# machine account quota
cme ldap "domain_controller" -d "domain" -u "user" -p "password" -M maq
# users description
cme ldap "domain_controller" -d "domain" -u "user" -p "password" -M get-desc-users
The PowerShell equivalent to CrackMapExec's
subnets modules is the following[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Sites.Subnets
LDAP anonymous binding is usually disabled but it's worth checking. It could be handy to list the users and test for ASREProasting (since this attack needs no authentication).
Last modified 6d ago