LDAP/LDAPS Enumeration (389, 636)

#

Quick failure checklist

#

If LDAP tools fail, check in this order:

1. time sync against the DC
2. DC IP/FQDN and /etc/hosts entry
3. DNS resolution for the domain and DC
4. bind format: user@$DOMAIN vs $DOMAIN\user
5. reachability to 389 and 636 from the host you are running from
6. whether the creds actually work on SMB/WinRM against the same target

Query naming contexts

#

ldapsearch -x -H ldap://$IP -s base namingcontexts

Check who you are after an authenticated bind

#

ldapwhoami -x -H ldap://$IP -D "$USER@$DOMAIN" -w "$PASS"
ldapwhoami -x -H ldap://$IP -D "$DOMAIN\\$USER" -w "$PASS"

Authenticated rootDSE and base search

#

ldapsearch -x -H ldap://$IP -D "$DOMAIN\\$USER" -w "$PASS" -s base namingcontexts
ldapsearch -x -H ldap://$IP -D "$DOMAIN\\$USER" -w "$PASS" -b "DC=${DOMAIN//./,DC=}" "(objectClass=*)" dn

Anonymous LDAP search

#

ldapsearch -x -H ldap://$IP -b "DC=${DOMAIN//./,DC=}"

Check DC records if DNS is in play

#

dig @$IP _ldap._tcp.dc._msdcs.$DOMAIN SRV

Check LDAPS certificate

#

openssl s_client -connect $IP:636 -servername $DOMAIN

If BloodHound or SharpHound fails

#

Do not stop at the collector failure.

• verify LDAP with ldapwhoami / ldapsearch first
• rerun from a domain-joined foothold if possible
• fall back to manual enumeration in Active Directory