🖊️ Author: Nairuz Abulhul

🌐 Blog: R3dbuck3t

Table of Contents

LDAP Overview

LDAP supports three authentication methods: anonymous, simple and SASL:

Anonymous: The client does not authenticate to the directory. This is equivalent to the anonymous credential level.

Simple: The client binds to the server by sending it’s DN and password in the clear. The primary advantages of using the simple authentication method are that all directory servers support it and that it is easy to set up.

SASL: This means that the LDAP client and server can be configured to negotiate and use possibly nonstandard and/or customized mechanisms for authentication, depending on the level of protection desired by the client and the server

##OLD Note###
Queries some users — — found vbs “ LOGON SCRIPTS” LOGON Scripts
Logon scripts are generally stored on the domain controller in the Netlogon share, which is located at %systemroot%\System32\Repl\Imports\Scripts folder. Once this script is placed in the Netlogon share, it will automatically replicate to all domain controllers in the domain.

LDAP Enumeration Tips

• [ ] Get the DC name
• [ ] Enumerate Users objects
• [ ] Enumerate Groups, focus on "member of CN ="
• CN = Common Name
• OU = Organizational Unit
• DC = Domain Component

Ex: Member of CN= Audit

• [ ] Look for importance groups such as Audit, Remote Management, AD Recycle Bin
• [ ] Check service accounts or any account with CN= AD Recycle Bin - Older version of windows servers support that. Ex : Windows 2008 R2
• [ ] Enumerate Passwords , use grep to find pass, password, passwd, Pwd, pwd, badPwdCount, LegacyPwd
• [ ] Custom attribute that contains the user’s password
• [ ] AAD start account is Azure Active Directory account

Attack Vectors: