python - ldap3

Manual LDAP Enumeration

Attackers can perform manual LDAP enumeration using Python. Follow the steps given below to perform manual LDAP enumeration using Python:

1. Using Nmap, check whether the target LDAP server is listening on port 389 for LDAP and port 636 for secure LDAP.

2. If the target server is listening on the specified ports, initiate the enumeration process by installing LDAP using the following command:

   pip3 install ldap3
   

3. As shown in the code given below, create a server object (server), specify the target IP address or hostname and port number. If the target server is listening on secure LDAP, specify use_ssl = True.

4. Retrieve the Directory System Agent (DSA)–specific entry (DSE) naming contexts by specifying get_info = ldap3.ALL.

5. Now, create a connection object, connection, and initiate a call to bind().

6. If the connection is successful, True is displayed on the screen as follows:

   >>> import ldap3
   >>> server = ldap3.Server('10.10.1.22', get_info = ldap3.ALL, port =389)
   >>> connection = ldap3.Connection(server)
   >>> connection.bind()
   True
   

7. Now, one can fetch information such as the domain name and naming context using the following script:

   >>> server.info
   

8. After obtaining the naming context, retrieve all the directory objects using the script given below:

   >>> connection.search(search_base='DC=DOMAIN,DC=DOMAIN', search_filter='(&(objectClass=*))', search_scope='SUBTREE', attributes='*')
   True
   >> connection.entries
   

9. Now, use the following script to dump the entire LDAP:

   >> connection.search(search_base='DC=DOMAIN,DC=DOMAIN', search_filter='(&(objectClass=person))', search_scope='SUBTREE', attributes='userPassword')
   True
   >>> connection.entries