Create ldap_enumeration.md

2024-11-21 10:23:02 +00:00 · 2024-09-28 00:36:20 -04:00 · 2024-09-28 00:36:20 -04:00 · fbde8123d9
commit fbde8123d9
parent 3d52ee24f0
1 changed files with 356 additions and 0 deletions
--- a/windows/ldap_enumeration.md
+++ b/windows/ldap_enumeration.md
@ -0,0 +1,356 @@
+# Useful LDAP Queries
+
+Lightweight Directory Access Protocol (LDAP) is a protocol used to access and manage directory information services over an IP network. In Windows Active Directory (AD) domains, LDAP plays a crucial role in storing and retrieving a vast amount of information, including user accounts, group memberships, computer accounts, and more. For penetration testers and security professionals, querying LDAP can reveal valuable insights into the domain's structure, potential misconfigurations, and vulnerabilities.
+
+
+## Understanding LDAP Query Operators
+
+Some LDAP queries utilize special comparison operators, particularly when filtering based on attributes like `userAccountControl`. Understanding these operators is essential for crafting effective queries.
+
+| Operator                               | OID                      | Description                                                                                                                                                                                                                                                     |
+|----------------------------------------|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| **LDAP_MATCHING_RULE_BIT_AND**         | `1.2.840.113556.1.4.803` | Performs a bitwise "AND" operation. Useful for checking if specific bits are set in an attribute like `userAccountControl`.                                                                                                                                     |
+| **LDAP_MATCHING_RULE_BIT_OR**          | `1.2.840.113556.1.4.804` | Performs a bitwise "OR" operation.                                                                                                                                                                                                                              |
+| **LDAP_MATCHING_RULE_TRANSITIVE_EVAL** | `1.2.840.113556.1.4.1941`| Performs a recursive search of a link attribute. Useful for finding all members of a group, including nested group members. [See Microsof's documentation](https://docs.microsoft.com/en-us/windows/win32/adschema/adschema-search-filter-syntax) |
+| **LDAP_MATCHING_RULE_DN_WITH_DATA**    | `1.2.840.113556.1.4.2253`| Matches portions of values of syntax `Object(DN-String)` and `Object(DN-Binary)`.                                                                                                                                                                               |
+
+---
+
+## Users
+
+### List All Users
+
+To retrieve all user accounts in the domain, you can use the following query:
+
+```ldap
+(&(objectCategory=person)(objectClass=user))
+```
+
+- **Explanation:**
+  - `(objectCategory=person)`: Filters objects categorized as a person.
+  - `(objectClass=user)`: Ensures the object is a user account.
+
+**Example Command:**
+
+```bash
+ldapsearch -x -b "dc=hacker26,dc=com" "(&(objectCategory=person)(objectClass=user))"
+```
+
+### List All Kerberoastable Users
+
+Kerberoasting is an attack technique that targets Service Principal Names (SPNs) associated with user accounts. To find all kerberoastable users:
+
+```ldap
+(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
+```
+
+- **Explanation:**
+  - `(objectClass=user)`: Targets user accounts.
+  - `(servicePrincipalName=*)`: Selects users with an SPN defined.
+  - `(!(cn=krbtgt))`: Excludes the `krbtgt` account.
+  - `(!(userAccountControl:1.2.840.113556.1.4.803:=2))`: Excludes disabled accounts.
+
+**Additional Example:**
+
+To include only accounts with a specific SPN:
+
+```ldap
+(&(objectClass=user)(servicePrincipalName=HTTP/*))
+```
+
+### List All AS-REP Roastable Users
+
+AS-REP roasting targets user accounts that do not require Kerberos preauthentication. To find such users:
+
+```ldap
+(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))
+```
+
+- **Explanation:**
+  - The `4194304` flag corresponds to `DONT_REQ_PREAUTH`.
+
+### Find Users Who Need to Change Password on Next Login
+
+```ldap
+(&(objectCategory=user)(pwdLastSet=0))
+```
+
+- **Explanation:**
+  - `(pwdLastSet=0)`: Indicates the password must be changed at next logon.
+
+### Find Users Who Are Almost Locked Out
+
+Assuming the account lockout threshold is 5, find users with 4 failed attempts:
+
+```ldap
+(&(objectCategory=user)(badPwdCount>=4))
+```
+
+- **Explanation:**
+  - `(badPwdCount>=4)`: Users with 4 or more bad password attempts.
+
+### Find Users with Passwords in Description
+
+Sometimes, passwords are mistakenly stored in the `description` attribute:
+
+```ldap
+(&(objectCategory=user)(|(description=*pass*)(description=*pwd*)))
+```
+
+- **Explanation:**
+  - Searches for `pass` or `pwd` in the `description` field.
+
+**Additional Example:**
+
+To find users with passwords in `comment` or `info` fields:
+
+```ldap
+(&(objectCategory=user)(|(comment=*pass*)(info=*pass*)))
+```
+
+### List Users Protected by `adminCount`
+
+The `adminCount` attribute indicates that an object has had its Access Control Lists (ACLs) modified due to membership in administrative groups.
+
+```ldap
+(&(objectCategory=user)(adminCount=1))
+```
+
+- **Explanation:**
+  - Identifies users with `adminCount` set to `1`, implying administrative privileges.
+
+---
+
+## Groups
+
+### List All Groups
+
+Retrieve all group objects in the domain:
+
+```ldap
+(objectCategory=group)
+```
+
+**Example Command:**
+
+```bash
+ldapsearch -x -b "dc=hacker26,dc=com" "(objectCategory=group)"
+```
+
+### List Groups Protected by `adminCount`
+
+```ldap
+(&(objectCategory=group)(adminCount=1))
+```
+
+- **Explanation:**
+  - Identifies groups with administrative privileges.
+
+### Find Groups with Specific Members
+
+To find groups that a particular user is a member of:
+
+```ldap
+(&(objectCategory=group)(member=cn=Username,ou=Users,dc=hacker26,dc=com))
+```
+
+- **Explanation:**
+  - Replace `cn=Username,ou=Users,dc=hacker26,dc=com` with the user's distinguished name (DN).
+
+### List Empty Groups
+
+Groups without members might indicate misconfigurations:
+
+```ldap
+(&(objectCategory=group)(!(member=*)))
+```
+
+---
+
+## Services
+
+### List All Service Principal Names (SPNs)
+
+SPNs are unique identifiers for services running on servers. To list all SPNs:
+
+```ldap
+(servicePrincipalName=*)
+```
+
+**Example Command:**
+
+```bash
+ldapsearch -x -b "dc=hacker26,dc=com" "(servicePrincipalName=*)"
+```
+
+### List Specific Services Based on SPNs
+
+To find specific services, filter by the SPN prefix. For example, to find HTTP services:
+
+```ldap
+(servicePrincipalName=HTTP/*)
+```
+
+- **Explanation:**
+  - `HTTP/*`: Matches any SPN starting with `HTTP/`.
+
+**Additional Examples:**
+
+- Find MSSQL services:
+
+  ```ldap
+  (servicePrincipalName=MSSQLSvc/*)
+  ```
+
+- Find LDAP services:
+
+  ```ldap
+  (servicePrincipalName=ldap/*)
+  ```
+
+### Find Accounts with Duplicate SPNs
+
+Duplicate SPNs can cause authentication issues:
+
+```ldap
+(&(servicePrincipalName=*)(!(&(objectClass=computer)(servicePrincipalName=*))))
+```
+
+- **Explanation:**
+  - Excludes computer accounts to focus on user accounts with SPNs.
+
+---
+
+## Computers
+
+### List All Computers
+
+Retrieve all computer accounts in the domain:
+
+```ldap
+(objectCategory=computer)
+```
+
+### List Computers Running a Specific Operating System
+
+For example, to find all computers running Windows Server 2019:
+
+```ldap
+(&(objectCategory=computer)(operatingSystem=Windows Server 2019*))
+```
+
+- **Explanation:**
+  - `(operatingSystem=Windows Server 2019*)`: Filters computers with OS starting with "Windows Server 2019".
+
+**Operating System Filters:**
+
+- Windows Server 2022: `Windows Server 2022*`
+- Windows 11: `Windows 11*`
+- Windows 10: `Windows 10*`
+
+### Find All Workstations
+
+Workstations are computers intended for end-users:
+
+```ldap
+(sAMAccountType=805306369)
+```
+
+- **Explanation:**
+  - `sAMAccountType=805306369`: Corresponds to workstations or member servers.
+
+### Find Computers with `KeyCredentialLink` Attribute
+
+This attribute can be associated with shadow credentials:
+
+```ldap
+(&(objectClass=computer)(msDS-KeyCredentialLink=*))
+```
+
+### Find Computers with Obsolete Operating Systems
+
+Identifying outdated systems is crucial for security:
+
+```ldap
+(&(objectCategory=computer)(|(operatingSystem=Windows XP*)(operatingSystem=Windows Vista*)(operatingSystem=Windows 7*)))
+```
+
+- **Explanation:**
+  - Filters computers running Windows XP, Vista, or 7.
+
+**Extended Example:**
+
+To include obsolete server OS versions:
+
+```ldap
+(&(objectCategory=computer)(|(operatingSystem=Windows NT*)(operatingSystem=Windows 2000*)(operatingSystem=Windows Server 2003*)(operatingSystem=Windows Server 2008*)))
+```
+
+---
+
+## Advanced Queries
+
+### Find All Domain Admins
+
+To list all members of the Domain Admins group, including nested group members:
+
+```ldap
+(memberOf:1.2.840.113556.1.4.1941:=cn=Domain Admins,cn=Users,dc=hacker26,dc=com)
+```
+
+- **Explanation:**
+  - Uses `LDAP_MATCHING_RULE_TRANSITIVE_EVAL` to recursively search group memberships.
+
+### Find Users with Password Never Expires
+
+Users with passwords that never expire can be a security risk:
+
+```ldap
+(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))
+```
+
+- **Explanation:**
+  - The `65536` flag corresponds to `DONT_EXPIRE_PASSWORD`.
+
+### Find Disabled Computer Accounts
+
+```ldap
+(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=2))
+```
+
+- **Explanation:**
+  - The `2` flag corresponds to `ACCOUNTDISABLE`.
+
+---
+
+## Tools for Executing LDAP Queries
+
+Several tools can execute LDAP queries against Active Directory:
+
+- **ldapsearch:** A command-line tool available on Linux and Windows via OpenLDAP.
+
+  **Example:**
+
+  ```bash
+  ldapsearch -x -H ldap://domaincontroller.example.com -D "user@example.com" -W -b "dc=hacker26,dc=com" "(objectCategory=person)"
+  ```
+
+- **PowerShell:** Use the `Get-ADUser`, `Get-ADGroup`, and `Get-ADComputer` cmdlets.
+
+  **Example:**
+
+  ```powershell
+  Get-ADUser -Filter * -Properties *
+  ```
+
+- **AD Explorer:** A GUI tool for browsing Active Directory.
+
+---
+
+## Additional References
+
+- [Microsoft Docs: LDAP Query Basics](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax)
+- [Understanding User Account Control Flags](https://support.microsoft.com/en-us/topic/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-properties-1b4707aa-9cd5-4f52-9c64-a67b6ceb1c8f)
+- [MS-DRSR Documentation](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/ed5db046-d9f7-4da4-884c-e14b6bcf5471)
+- [Active Directory Security: LDAP Syntax Filters](https://adsecurity.org/?p=1275)
+