killchain-compendium/Enumeration/LDAP.md

# Leightweight Directory Acess Protocol (LDAP)

LDAP structures directory objects in a tree structure for a given domain which
is used to inherit permissions from root and parent objects. The protocol is
used for authentication and authorization of groups, users and resources,
called Organizational Units (OUs). The root object is a top level domain.

Organizational Units are Distinguished Names (DN) which represent the path to
an object inside the tree.  Parts  of the DN are named Relative Distinguished
Names (RDN). The Distinguished Names have properties attached which contain
additional information.

Ports:

* 389, without encryption or StartTLS
* 636, with encryption enabled

## Get Domain

Use the `ldapsearch` tool to receive information from an LDAP server.

```sh
ldapsearch -H ldap://$TARGET_IP -x -s base namingcontexts
```

* Use found namingcontexts DC

```sh
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>
```

* Authenticated LDAP Search

```sh
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>' -D '<DC>\<user>' -W > outfile
```

## Domain Dump

If a set of LDAP credentials is known dump the domain via

```sh
ldapdomaindump $TARGET_IP  -u '<domain>\<user>' -p '<password>' --no-json --no-grep
```

The result is a set of HTML files, take a look at them.

## Query LDAP Objects

LDAP objects can be queried for information retrieval.
A query starts with a DN followed by the scope, a filter for criteria and
additional attributes.

A filter searching for a user's common name including a wildcard may look likes this.

```sh
ldapsearch -H ldap://$TARGET_IP -x -b "DC=<DC>,DC=<ORG>" "(&(objectClass=user)(|(cn=Max*)(cn=Furiosa*)))"
```

### Vulnerabilities of Queries

Queries are vulnerable to unvalidated input, e.g. just using a wildcard instead
of a password or username.

```sh
(&(username=*)(password=*))
```

If the targeted user would be named Maximilian the query may look like this.

```sh
(&(username=Max*)(password=*))
```

There is also the possibility of using a tautology based attack like they are
used for SQL injections. They way they are done in LDAP queries is the following.

```sh
(&(username=*)(|(&)(password=password))
```

The tautology is introduced through `(&)`, which sets the condition of the
password check to true.

Other injections like blind based are also possible through boolean or error based responses, providing information about the state of the LDAP query.