> For the complete documentation index, see [llms.txt](https://man.protyro.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://man.protyro.eu/active-directory/attack-vectors/ldap.md).

# LDAP

LDAP can be enumerate in a way to gain credentials

## Resources

{% embed url="<https://medium.com/@minimalist.ascent/pentesting-ldap-servers-25577bde675b>" %}

## Enumerate LDAP

`nmap -n -sV --script "ldap* and not brute" -p 389 <DC IP>`

### Bind enumeration

`ldapsearch -x -b "dc=acme,dc=com" "*" -h 148.32.42.5 | awk '/dn: / {print $2}'`

`ldapsearch -x -D "cn=admin,dc=acme,dc=com" -s sub "cn=*" -h 148.32.42.5 | awk '/uid: /{print $2}' | nl`

### Get the authentication method

`ldapwhoami -h ldap.acme.com -w "abcd123"`

## Dictionary attack to find valid users <a href="#id-2bfa" id="id-2bfa"></a>

Use the `ldap-users.pl` script based on`cewl` scan or on my `userslist.sh` script. (see my github)

A website is a good way to get inspired.

## Dictionary attack to find valid password <a href="#id-6e20" id="id-6e20"></a>

Once we have a valid list of users, we can move forward to search for valid user and password combinations.

Use the `ldap-pass.pl` based on the word list of your choice.&#x20;

This article can help : <https://www.hackingarticles.in/5-ways-create-dictionary-bruteforcing/>

## Using ldapwhoami to gain access

Use `ldapwhoami-dictonary.sh`&#x20;

## Dumping data

`ldapsearch -D "cn=admin,dc=acme,dc=com" "(objectClass=*)" -w ldapadmin -h ldap.acme.com`

## Cracking OpenLDAP Passwords <a href="#id-43bc" id="id-43bc"></a>

The password hashes are encoded in base64 we can easly decode the string to extract the hash.

`echo "e01ENX0wTHVBcXJ1R0diYmpVUlB3TG5KMUt3PT0=" | base64 -d`

All these hashes can be loaded up in JTR and cracked to get shell access on the remote system.