Discover the search base, then request useful account fields ldapsearch -x -H ldap://DC_HOST -s base -b '' defaultNamingContext namingContexts dnsHostName ldapsearch -x -ZZ -H ldap://DC_HOST -D 'USER@DOMAIN' -W -b 'BASE_DN' -E pr=1000/noprompt '(samAccountType=805306368)' sAMAccountName description info memberOf servicePrincipalName Replace BASE_DN with the returned domain naming context. The second command prompts for the known password and requires STARTTLS plus a trusted server certificate. A valid RootDSE response does not prove anonymous subtree access. Account descriptions, memberships and SPNs give candidate identities/services; check their context and permissions before use. sizeLimitExceeded means partial results; pagination helps when supported. Use AD rights validation for a promising object, rather than requesting every attribute from every object. OpenLDAP search options. Check null credentials or if your credentials are valid: ldapsearch -x -H ldap:// -D '' -w '' -b "DC=<1_SUBDOMAIN>,DC=" ldapsearch -h -bx "DC=,DC=" ldapsearch -x -H ldap:// -D '\' -w '' -b "DC=<1_SUBDOMAIN>,DC=" # CREDENTIALS NOT VALID RESPONSE search: 2 result: 1 Operations error text: 000004DC: LdapErr: DSID-0C090A4C, comment: In order to perform this opera tion a successful bind must be completed on the connection., data 0, v3839 "A successful bind must be completed" means this query lacks an accepted authenticated context; it does not alone prove the supplied password is incorrect. Check the bind result, identity format and required TLS/signing. LDAP result 49 indicates an authentication rejection and its diagnostic may distinguish a bad secret from account restrictions. You can extract everything from a domain using: ldapsearch -x -H ldap:// -D '\' -w '' -b "DC=<1_SUBDOMAIN>,DC=" -x Simple Authentication -H LDAP Server -D My User -w My password -b Base site, all data from here will be given Extract users: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=Users,DC=<1_SUBDOMAIN>,DC=" #Example: ldapsearch -x -H ldap:// -D 'MYDOM\john' -w 'johnpassw' -b "CN=Users,DC=mydom,DC=local" Extract computers: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=Computers,DC=<1_SUBDOMAIN>,DC=" Extract my info: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=,CN=Users,DC=<1_SUBDOMAIN>,DC=" Extract Domain Admins: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=Domain Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=" Extract Domain Users: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=Domain Users,CN=Users,DC=<1_SUBDOMAIN>,DC=" Extract Enterprise Admins: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=Enterprise Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=" Extract Administrators: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=Administrators,CN=Builtin,DC=<1_SUBDOMAIN>,DC=" Extract Remote Desktop Group: ldapsearch -x -H ldap:// -D '\' -w '' -b "CN=Remote Desktop Users,CN=Builtin,DC=<1_SUBDOMAIN>,DC=" To see if you have access to any password you can use grep after executing one of the queries: | grep -i -A2 -B2 "userpas" Please, notice that the passwords that you can find here could not be the real ones...

OSCP notes