> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/infra-pentesting/active-directory-ad-initial-attacks/ldap.md).

# LDAP

LDAP enumeration in Active Directory environments

## ldapsearch

### Null bind - get naming context

```
# ldapsearch null bind
(-x ) simple (anonymous) authentication, otherwise MD5
(-s ) scope
(-b ) basedn .. base domain name

# search for naming context 
namingContexts: DC=htb,DC=local
```

```
ldapsearch -H ldap://10.129.95.210 -x -s base
```

### Null bind - set naming context - base domain name

```
ldapsearch -H ldap://10.129.95.210:389 -x -b "dc=htb,dc=local"
```

### Account enumeration

```
ldapsearch -H ldap://10.129.95.210:389 -x -b DC=htb,DC=local "(objectClass=person)" | grep "sAMAccountName:"
```

```
ldapsearch -H ldap://10.129.95.210:389 -x -b "dc=htb,dc=local"
ldapsearch -H ldap://10.129.95.210:389 -x -b DC=htb,DC=local "(objectClass=person)" | grep "sAMAccountName:"
ldapsearch -H ldap://10.129.95.210 -x -b DC=htb,DC=local | grep -A 11 -i "Remote Management Users"
```

### Domain authentication (-D) 

```
ldapsearch -h ldap.server -D username@domain.htb -w 'password' -b "dc=support,dc=htb" "*"
```

```
ldapsearch -H ldap://support.htb -D ldap@support.htb -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "dc=support,dc=htb" "Administrator" 
```

{% embed url="<https://www.baeldung.com/linux/ldap-command-line-authentication>" %}

## Apache Directory Studio - LDAP GUI client

![](https://1354665097-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYLPTPmXutfLTHzDEhx%2Fuploads%2FQEG6ve4l17OoxILzLXCW%2Fimage.png?alt=media\&token=80c07777-1a12-47aa-be24-540d6094115b)

{% embed url="<https://directory.apache.org/studio/>" %}

<https://directory.apache.org/studio/downloads.html>

## windapsearch

```
git clone https://github.com/ropnop/windapsearch

apt-get install libsasl

pip install ldap
pip install python-ldap     

# (-U) users
python3 windapsearch.py -d htb.local --dc-ip 10.129.95.210 -U
```