> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/ldap-enumeration.md).

# LDAP Enumeration

LDAP (Lightweight Directory Access Protocol) is used in Active Directory environments to access and manage directory information. This section focuses on practical enumeration techniques using tools and Nmap scripts.

***

### 🧠 Scenario

* 🧑‍💻 **Attacker Machine**: Your Kali Linux machine
* 🖥️ **Target (Domain Controller)**: `192.168.1.100`
* 🌐 **Domain**: `enum.local`
* 👤 **User (for auth)**: `enum\Administrator`
* 🔐 **Password**: `P@ssw0rd123`

***

### Nmap for LDAP Enumeration

#### Full Port Scan (Optional)

```bash
nmap -v -p- 192.168.1.100
```

#### Enumerate Root DSE and LDAP Info

```bash
nmap -v -p 389,636 --script=ldap-rootdse.nse 192.168.1.100
nmap -v -p 389,636 --script=ldap-search.nse 192.168.1.100
```

#### NSE Scripts Used

* `ldap-rootdse.nse`: Retrieves Root DSE info (e.g., naming contexts).
* `ldap-search.nse`: Performs LDAP search queries.

***

### Tools for Manual Enumeration

#### JXplorer (GUI)

Use it to explore LDAP objects visually.

* Host: `192.168.1.100`
* Port: `389`
* Base DN: `dc=enum,dc=local`
* Bind DN: `enum\Administrator`
* Password: `P@ssw0rd123`

***

#### `ldapsearch` (CLI)

**Anonymous Enumeration**

```bash
ldapsearch -x -H ldap://192.168.1.100 -b "dc=enum,dc=local"
```

```bash
ldapsearch -x -H ldap://192.168.100 -D '' -w '' -b "DC=enum,DC=local"
```

```bash
ldapsearch -x -H ldap://192.168.1.100 -b "dc=enum,dc=local" "(objectclass=*)"
```

**Authenticated Enumeration**

```bash
ldapsearch -x -H ldap://192.168.1.100 -D "enum\\Administrator" -w "P@ssw0rd123" -b "dc=enum,dc=local"
```

**Output to File**

```bash
ldapsearch -x -H ldap://192.168.1.100 -b "dc=enum,dc=local" "(objectclass=*)" > ldap-output.txt
```

***

### Parsing Output

#### Extract All Usernames

```bash
grep "userPrincipalName" ldap-output.txt | cut -d ' ' -f2
```

#### Search for Passwords / Sensitive Fields

```bash
grep -i pass ldap-output.txt
grep -i description ldap-output.txt
```

***

### Scoping with ldapsearch

#### Get Naming Contexts (Sub and Base Scope)

```bash
ldapsearch -x -H ldap://192.168.1.100 -s base -b "" "(objectclass=*)" "*" +
```

```
ldapsearch -x -H ldap://192.168.1.100 -s sub -b "dc=enum,dc=local"
```

```
ldapsearch -x -H ldap://192.168.1.100 -s basenmingcontexts
```

***

### Password Reset Using SMB

If LDAP reveals a user's initial password and it must be changed:

#### Error: `NT_STATUS_PASSWORD_MUST_CHANGE`

```bash
smbclient //192.168.1.100/Common -U "john.doe"
```

#### Fix with smbpasswd

```bash
smbpasswd -U john.doe -r 192.168.1.100
```

* You'll be prompted to set a new password.