389 - LDAP
Introduction
Port: 389 (TCP)
The Lightweight Directory Access Protocol (LDAP) enables anyone to locate data about organisations, users, devices, and other static data within directories. It works with printers, computers, and other devices connected via the Internet or a companyâs intranet.
Furthermore, LDAP is a tool for extracting and editing data stored in Active Directory. Each user account in an AD has several attributes, such as the userâs full name and passwords. This information can be easily retrieved by sending string-based queries that match the specified filters.
Comparison operators: =, >=,<=,~=
Also, a filter can be the combination of other filters using boolean operators.
Boolean operators: &, |, !
For example, the following filter searches for all the users whose common name contains "Marmeus".
General Enumeration
Using Nmap without proving any credentials the attacker could retrieve:
Available LDAP public information
The root DSA-specific Entry (DSE)
Impacket
If the attacker has already used AD user credentials, the impacket program GetADUsers.py could gather data about the domain's users and their corresponding email addresses.
Ldapsearch
Ldapsearch allows the attacker to dump the available LDAP information by using anonymous or null binding user credentials.
There are different levels of scope:
Base: Examines only the level specified by the base DN.
One: Examines only the level immediately below the base DN
Sub: Examines the subtree below the base DN and includes the base DN level.
Useful base dn for search
Here you have some base dn for search:
Find Naming Contexts (Get base domain):
Obtain more information about the domain.
'DC=<DOMAIN>,DC=<TLD>'
Find users:
"CN=Users,DC=<DOMAIN>,DC=<TLD>"
Show user information.
"CN=<USERNAME>,CN=Users,DC=<DOMAIN>,DC=<TLD>"
Find computers:
"CN=Computers,DC=<DOMAIN>,DC=<TLD>"
Find Administrators:
"CN=*Admin*,CN=Users,DC=<DOMAIN>,DC=<TLD>"
Find Domain users:
"CN=Domain Users,CN=Users,DC=<DOMAIN>,DC=<TLD>"
Show Remote Desktop Group members:
"CN=Remote Desktop Users,CN=Builtin,DC=<DOMAIN>,DC=<TLD>"
Find ServicePrincipalName accounts:
"(&(samAccountType=805306368)(servicePrincipalName=*))"
Finally, with the following command, you can obtain the number of object occurrences in order to identify less common ones.
References
Last updated