LDAP Enumeration

Overview

Various protocols enable communication and manage data transfer between network resources. All these protocols carry valuable information about network resources along with the data. An external user who successfully enumerates that information by manipulating the protocols can break into the network and may misuse the network resources. The Lightweight Directory Access Protocol (LDAP) is one such protocol that accesses the directory listings.

LDAP Protocol

LDAP is an Internet protocol for accessing distributed directory services. LDAP accesses directory listings within Active Directory or from other directory services. LDAP is a hierarchical or logical form of a directory, similar to a company's organizational chart. Directory services may provide any organized set of records, often in a hierarchical and logical structure, such as a corporate email directory. It uses DNS for quick lookups and the fast resolution of queries.

A client starts an LDAP session by connecting to a Directory System Agent (DSA), typically on TCP port 389, and sends an operation request to the DSA. The Basic Encoding Rules (BER) format is used to transmit information between the client and server.

An attacker can anonymously query the LDAP service for sensitive information such as usernames, addresses, departmental details, and server names, which an attacker can use to launch attacks.

Manual and Automated LDAP Enumeration

Attackers can use both manual and automated approaches for LDAP enumeration.

Automated LDAP Enumeration

Attackers use the ldap-brute NSE script to brute-force LDAP authentication. By default, it uses the built-in username and password lists. The userdb and passdb script arguments can be employed to use custom lists.

nmap -p 389 --script ldap-brute --script-args=ldap-brute.hostname=10.10.1.22 10.10.1.22

nmap -p 389 --script ldap-brute --script-args ldap.base='"cn=users,dc=CEH,dc=com"' <Target IP Address>

nmap -p 389 --script ldap-brute,ldap-search --script-args=ldap-brute.hostname=10.10.1.22 10.10.1.22

LDAP Enumeration Tools

There are many LDAP enumeration tools that access directory listings within Active Directory (AD) or other directory services. Using these tools, attackers can enumerate information such as valid usernames, addresses, and departmental details from different LDAP servers.

Softerra LDAP Administrator

Source: https://www.ldapadministrator.com

Softerra LDAP Administrator is an LDAP administration tool that works with LDAP servers such as Active Directory (AD), Novell Directory Services, and Netscape/iPlanet. It browses and manages LDAP directories. As shown in the screenshot, attackers use Softerra LDAP Administrator to enumerate user details such as the username, email address, and department.

ldapsearch -x -LLL -H ldap://ipa.example.com -D "uid=admin,cn=users,cn=accounts,dc=example,dc=com" -W -b "uid=user1,cn=users,cn=accounts,dc=example,dc=com" uid

ldapsearch -H ldap://ldap.example.com:389 -D "cn=admin,dc=example,dc=com" -w secret123 -b "ou=people,dc=example,dc=com" "([email protected])"

Flags


-H	Host
-D	DN
-w	password
-b	BaseDN

ldapsearch

Source: https://linux.die.net

ldapsearch is a shell-accessible interface for the ldap_search_ext(3) library call. ldapsearch opens a connection to an LDAP server, binds it, and performs a search using the specified parameters. The filter should conform to the string representation of the search filters, as defined in RFC 4515. If not provided, the default filter, (objectClass=*), is used.

If ldapsearch finds one or more entries, the attributes specified by attrs are returned. If * is listed, all user attributes are returned. If + is listed, all operational attributes are returned. If no attrs are listed, all user attributes are returned. If only 1.1 is listed, no attributes are returned.

The search results are displayed using an extended version of the LDAP Data Interchange Format (LDIF). The option -L controls the output format.

Basic Commands

Attackers use ldapsearch to enumerate AD users. This allows attackers to establish connections with an LDAP server to perform different searches using specific filters.

Basic LDAP search using simple authentication:

ldapsearch -h <Target IP Address> -x

Obtain additional details related to the naming contexts:

ldapsearch -h <Target IP Address> -x -s base namingcontexts

Obtain more information about the primary domain:

ldapsearch -h <Target IP Address> -x -b "DC=htb,DC=local"

Advanced Commands

Retrieve information about a specific object:

ldapsearch -h <Target IP Address> -x -b "DC=htb,DC=local" '(objectClass=Employee)'

→ retrieves information related to the object class Employee.

Retrieve information about all objects in a directory tree:

ldapsearch -x -h <Target IP Address> -b "DC=htb,DC=local" "objectclass=*"

→ retrieves information related to all the objects in the directory tree.

Retrieve a list of users belonging to a particular object class:

ldapsearch -h <Target IP Address> -x -b "DC=htb,DC=local" '(objectClass=Employee)' sAMAccountName sAMAccountType

Additional LDAP Enumeration Tools

AD Explorer (https://docs.microsoft.com)
LDAP Admin Tool (https://www.ldapsoft.com)
LDAP Account Manager (https://www.ldap-account-manager.org)
LDAP Search (https://securityxploded.com)