LDAP

ldapsearch

ldapsearch -H ldap://[IP] -x -s base namingcontexts

ldapsearch -H ldap://[IP] -x -b "DC=certified,DC=htb" 
ldapsearch -H ldap://[IP] -x -b "DC=vintage,DC=htb" -D "P.Rosa@vintage.htb" -w "Rosaisbest123"
ldapsearch -x -H ldap://172.16.20.2 -s base -b "" -LLL | grep dnsHostName
dnsHostName: DC02.darkzero.ext

Username/Passwordspray/bruteforce

./kerbrute userenum --dc [IP] -d [domain] /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

Netexec

  • whoami

nxc ldap DC.voleur.htb -d voleur.htb -u 'todd.wolfe' -p 'NightT1meP1dg3on14' -k -M whoami

PreviousNATNextmimikatz

Last updated