LDAP

Ldapsearch

Namingcontexts

ldapsearch -H ldap://10.10.10.10 -x -s base namingcontexts

Anonymous access

ldapsearch -H ldap://10.10.10.10 -x -b 'dc=qu35t,dc=pw'

Users + Description

ldapsearch -H ldap://10.10.10.10 -x -b 'dc=qu35t,dc=pw' "user" "description"

With NTML authentication

ldapsearch -H ldap://10.10.10.10 -x -D [e-mail] -w 'Password1!' -s base

With Kerberos authentication

First, add the ticket to klist.

ldapsearch -H ldap://10.10.10.10 -Y GSSAPI -s base

Ldapsearch-ad

Informations

ldapsearch-ad -l 10.10.10.10 -t info

Whoami

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t whoami

Trusts

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t trusts

Password Policy

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t pass-pols

Admins

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t admins

Kerberoast

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t kerberoast

Asreproast

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t asreproast

Golden Ticket

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t goldenticket

All

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -p 'Passw0rd!' -t all

With NTML hash

ldapsearch-ad -l 10.10.10.10 -d qu35t.pw -u qu35t -hashes :32ed87bdb5fdc5e9cba88547376818d4 -t all 

Windapsearch

Enumerate domain admins

windapsearch.py --dc-ip 10.10.10.10 -u [e-mail] -p 'Password1!' --da

Enumerate AD privileged users

windapsearch.py --dc-ip 10.10.10.10 -u [e-mail] -p 'Password1!' -PU