9.2.11 Find domain identities and validate directory access LDAP and Kerberos Enumeration
← Stage index | AD procedures | Service cheatsheet | Strategy map | Study methods: Extract opportunities from services
Recognition: LDAP commonly appears on TCP/389 or TCP/636; Global Catalog on TCP/3268 or 3269; Kerberos on TCP/UDP 88. Applications may listen elsewhere, so follow protocol evidence rather than port labels.
9.2.11.1 Baseline: discover naming contexts
Prerequisite: LDAP reachability. Coverage: RootDSE only; this can work even when directory searches require authentication. Decisive output:
defaultNamingContextanddnsHostName.
ldapsearch -x -LLL -H ldap://TARGET:389 -s base -b '' \
defaultNamingContext rootDomainNamingContext configurationNamingContext dnsHostName
Convert DC=corp,DC=example into corp.example for DNS/Kerberos work. Preserve the server's exact hostname because Kerberos is name-sensitive.
9.2.11.1.1 LDAPS and certificate-name inspection
openssl s_client -connect TARGET:636 -servername DC_HOST </dev/null
ldapsearch -x -LLL -H ldaps://DC_HOST:636 -s base -b '' defaultNamingContext dnsHostName
A certificate can disclose domain/DC names. A TLS validation error is a client trust/name issue, not proof that LDAP is unavailable.
9.2.11.2 Check which directory objects are readable without credentials Anonymous directory search
Prerequisite: known base DN and server permitting anonymous search. Failure cue:
Inappropriate authenticationorInsufficient accesscloses only the anonymous path.
ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
'(&(objectCategory=person)(objectClass=user))' \
sAMAccountName userPrincipalName memberOf description
ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
'(objectClass=group)' cn member description
9.2.11.3 Query directory objects with your accepted identity Authenticated search
Prerequisite: a valid directory identity. Decisive output: objects/attributes unavailable anonymously. Avoid placing a real password in shell history when an interactive prompt is available.
ldapsearch -x -LLL -H ldap://DC_HOST:389 \
-D 'USER@DOMAIN.TLD' -W -b 'DC=DOMAIN,DC=TLD' \
'(&(objectCategory=person)(objectClass=user))' \
sAMAccountName userPrincipalName memberOf description servicePrincipalName userAccountControl
9.2.11.3.1 Search computers, groups and SPN-bearing accounts separately
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
-b 'DC=DOMAIN,DC=TLD' '(objectClass=computer)' \
dNSHostName operatingSystem operatingSystemVersion servicePrincipalName
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
-b 'DC=DOMAIN,DC=TLD' '(objectClass=group)' cn member
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
-b 'DC=DOMAIN,DC=TLD' '(&(objectCategory=person)(servicePrincipalName=*))' \
sAMAccountName servicePrincipalName memberOf
9.2.11.4 Kerberos prerequisites before an attack
Kerberos failures are often name/time/route failures rather than credential failures. Establish:
getent hosts DC_HOST
nc -nvz DC_IP 88
date -u
nmap -Pn -sV -p 88,389,445,464,636,3268,3269 DC_IP -oN dc-services.txt
Interpretation: resolve
DOMAINandDC_HOSTconsistently, keep clock skew within Kerberos tolerance, and ensure the KDC is reached through the selected route.KDC_ERR_C_PRINCIPAL_UNKNOWNpoints to identity/domain naming;KRB_AP_ERR_SKEWpoints to time;KDC_ERR_PREAUTH_FAILEDnormally points to authentication material.
9.2.11.5 Continue with the capability your result enables Handoff
- New users, groups, computers, SPNs or domain names → domain mapping.
- A user confirmed without preauthentication → Kerberos and identity transitions.
- Valid credentials → rerun authenticated LDAP plus SMB/share/remote-access enumeration.
- Certificate templates/AD CS clues → AD CS and object-control abuse.