d4Rk's 1337 h4x0r guide
About me
Search…
Introduction
Reconnaissance
Recon
OSINT
Enumeration
Network discovery
Port scanning
Webserver scanning
Exploit detection
Fuzzing
Process monitoring
Exploitation
Shells
Passwords
Web
Buffer overflow
Misc
Privilege escalation
Linux
Windows
Post exploitation
Loot
Pivoting
Standalone Tools
Services
TCP
TCP 21: FTP
TCP 22: SSH
TCP 23: Telnet
TCP 25, 587: SMTP
TCP 53: DNS
TCP 80, 443: HTTP(S)
TCP 88: Kerberos
TCP 110, 995: POP3(S)
TCP 111: rpcbind
TCP 135: MSRPC
TCP 139, 445: NetBIOS, SMB
TCP 143, 993: IMAP(S)
TCP 389, 636, 3268, 3269: LDAP
TCP 1433, UDP 1434: MSSQL Server
TCP 2049: NFS
TCP 3306: MySQL
TCP 3389: RDP
TCP 5985: WinRM
TCP 6379: Redis
TCP 27017: MongoDB
UDP
Misc
File transfer
Overview
Wget
Pure-FTPd
TFTP
VBScript: Wget clone
Misc
Bash
Burp Suite
Crypto
Ebowla
Firefox extensions
Impacket
Memory forensics
Metasploit Framework (MSF)
MITM
Msfvenom
Pass the Hash (PTH)
PowerShell
PowerShell on Linux
Wireshark
Wordlists and dictionaries
Bug Bounty
Platforms
Tools
Powered By GitBook
TCP 389, 636, 3268, 3269: LDAP
The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.
-- Wikipedia​

Related

Enumeration

ldapsearch

ldapsearch -x -h <ip> -s base namingcontexts
Using namingcontexts from previous call
ldapsearch -x -h <ip> -b 'dc=lightweight,dc=htb'
Look for userPasswords, description (sometimes admins put interessting stuff there)

windapsearch

Most stuff requires a valid user account
windapsearch.py --dc-ip <ip>
Dump all
./windapsearch.py --dc-ip <ip> -u <user> -p <pw> -G -U -PU -C --da --admin-objects --user-spns --unconstrained-users --unconstrained-computers --gpos --full

Capture requests (e.g. Wireshark)

Find password in request: LDAP -> bindRequest -> authentication: simple -> PASSWORD
Previous
TCP 143, 993: IMAP(S)
Next
TCP 1433, UDP 1434: MSSQL Server
Last modified 7mo ago
Copy link
Edit on GitHub
Outline
Related
Enumeration
ldapsearch
windapsearch
Capture requests (e.g. Wireshark)