LDAP

Pentesting LDAP - TCP Ports 389,3268,636,3269

Theory

LDAP (Lightweight Directory Access Protocol) is a software protocol for enabling anyone to locate organizations, individuals, and other resources such as files and devices in a network, whether on the public Internet or on a corporate intranet. LDAP is a "lightweight" (smaller amount of code) version of Directory Access Protocol (DAP).

An LDAP directory is organized in a simple "tree" hierarchy consisting of the following levels:

• The root directory (the starting place or the source of the tree), which branches out to

• Countries, each of which branches out to

• Organizations, which branch out to

• Organizational units (divisions, departments, and so forth), which branches out to (includes an entry for)

• Individuals (which includes people, files, and shared resources such as printers)

It run on port TCP 389 and 636(ldaps). The Global Catalog (LDAP in ActiveDirectory) is available by default on ports 3268, and 3269 for LDAPS.

Practice

A lot of information on an AD domain can be obtained through LDAP. Most of the information can only be obtained with an authenticated bind but metadata (naming contexts, DNS server name, Domain Functional Level (DFL)) can be obtainable anonymously, even with anonymous binding disabled.

UNIX-Like

ldapsearch

The ldapsearch command is a shell-accessible interface to the ldap_search_ext(3) library call. It can be used to enumerate essential informations.

Anonymous Enumeration:

Enumerate the base domain.

#Simple bind authentification (-x) as anonymous.
ldapsearch -H ldap://$IP -x -s base namingcontexts

Dump all readable ldap information as anonymous.

ldapsearch -H ldap://$IP -x -b "DC=contoso,DC=local"

Dump ldap information as anonymous and filter.

#With (objectClass=User) as the query and sAMAccountName the filter.
ldapsearch -H ldap://$IP -x -b "DC=contoso,DC=local" '(objectClass=User)' sAMAccountName

Authenticated Enumeration:

Dump readable ldap informations with NTLM based authentication

#With (objectClass=User) as the query and sAMAccountName the filter.
ldapsearch -H ldap://$IP -x -D "CN=MyUser,CN=Users,DC=contoso,DC=local" -w Password1 -b "DC=contoso,DC=local" '(objectClass=User)' sAMAccountName
ldapsearch -H ldap://$IP -x -D "[email protected]" -w Password1 -b "DC=contoso,DC=local" '(objectClass=User)' sAMAccountName

Dump all readable ldap informations with Kerberos based authentication

#Get TGT
kinit [email protected]

#List tickets
klist

#LdapSearch
ldapsearch -H ldap://$IP -Y GSSAPI -b "DC=contoso,DC=local" '(objectClass=User)' sAMAccountName

If you have the following error using ldaps: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1), it's probably because of an invalide certificate.

You can run following command to ignore the certificate:

LDAPTLS_REQCERT=never ldapsearch -x -H ldaps://<IP> [....] 

We may use ldapsearch output (also known as LDIF files) and covert it into JSON files ingestible by BloodHound using ldif2bloodhound. See this page for more informations.

ldeep

Powerview.py

NetExec

ldapdomaindump

ntlmrelayx

Windows

PowerShell

Using PowerShell and .NET classes, we can enumerate the domain using LDAP. This can be very handy if we have compromised a computer in the domain with no administrative access and no RSAT module installed.

To acheive this, we can use the following function.

ldapsearch.ps1

function LDAPSearch {
    param (
        [string]$LDAPQuery
    )

    $PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
    $DN = ([adsi]'').distinguishedName

    $DIR_ENTRY = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$PDC/$DN")

    $DIR_SEARCHER = New-Object System.DirectoryServices.DirectorySearcher($DIR_ENTRY, $LDAPQuery)

    return $DIR_SEARCHER.FindAll()

}

# Import the function
. .\ldapsearch.ps1

Then, we can use it as in following examples, by specifing our filter.

# Dump all objects
LDAPSearch -LDAPQuery '(objectClass=*)'

# Enum Users
## Filter on Users
LDAPSearch -LDAPQuery "(objectClass=User)"

## Print some properties for each users
$res = foreach ($obj in $(LDAPSearch -LDAPQuery "objectClass=User")) {$obj.properties | select {$_.name}, {$_.memberof}}
$res|fl

# Enum Groups
## Filter on Groups
LDAPSearch -LDAPQuery "(objectClass=Group)"

## Print some properties for each groups
$res = foreach ($obj in $(LDAPSearch -LDAPQuery "objectClass=Group")) {$obj.properties | select {$_.cn}, {$_.member}}
$res|fl

## Query for specific group and print a property
$res = LDAPSearch -LDAPQuery "(&(objectCategory=group)(cn=Domain Admins))"
$res.properties.member

PowerView

LDAP anonymous binding is usually disabled but it's worth checking. It could be handy to list the users and test for ASREProasting (since this attack needs no authentication).

Automation and scripting

• A more advanced LDAP enumeration can be carried out with BloodHound (see this).

• The enum4linux tool can also be used, among other things, for LDAP recon (see this).