ldapsearch
ldapsearch -x -LLL -H ldap://ipa.example.com -D "uid=admin,cn=users,cn=accounts,dc=example,dc=com" -W -b "uid=user1,cn=users,cn=accounts,dc=example,dc=com" uid
ldapsearch -H ldap://ldap.example.com:389 -D "cn=admin,dc=example,dc=com" -w secret123 -b "ou=people,dc=example,dc=com" "([email protected])"
Flags
ldapsearch
Source: https://linux.die.net
ldapsearch is a shell-accessible interface for the ldap_search_ext(3) library call. ldapsearch opens a connection to an LDAP server, binds it, and performs a search using the specified parameters. The filter should conform to the string representation of the search filters, as defined in RFC 4515. If not provided, the default filter, (objectClass=*), is used.
If ldapsearch finds one or more entries, the attributes specified by attrs are returned. If * is listed, all user attributes are returned. If + is listed, all operational attributes are returned. If no attrs are listed, all user attributes are returned. If only 1.1 is listed, no attributes are returned.
The search results are displayed using an extended version of the LDAP Data Interchange Format (LDIF). The option -L controls the output format.
Basic Commands
Attackers use ldapsearch to enumerate AD users. This allows attackers to establish connections with an LDAP server to perform different searches using specific filters.
Basic LDAP search using simple authentication:
ldapsearch -h <Target IP Address> -x
Obtain additional details related to the naming contexts:
ldapsearch -h <Target IP Address> -x -s base namingcontexts
Obtain more information about the primary domain:
ldapsearch -h <Target IP Address> -x -b "DC=htb,DC=local"
Advanced Commands
Retrieve information about a specific object:
ldapsearch -h <Target IP Address> -x -b "DC=htb,DC=local" '(objectClass=Employee)'
→ retrieves information related to the object class Employee.
Retrieve information about all objects in a directory tree:
ldapsearch -x -h <Target IP Address> -b "DC=htb,DC=local" "objectclass=*"
→ retrieves information related to all the objects in the directory tree.
Retrieve a list of users belonging to a particular object class:
ldapsearch -h <Target IP Address> -x -b "DC=htb,DC=local" '(objectClass=Employee)' sAMAccountName sAMAccountType