← Complete task index · Workspace

LDAP and Kerberos Enumeration

← Stage index | AD procedures | Service cheatsheet | Strategy map | Study methods: Extract opportunities from services

Recognition: LDAP commonly appears on TCP/389 or TCP/636; Global Catalog on TCP/3268 or 3269; Kerberos on TCP/UDP 88. Applications may listen elsewhere, so follow protocol evidence rather than port labels.

Baseline: discover naming contexts

Prerequisite: LDAP reachability. Coverage: RootDSE only; this can work even when directory searches require authentication. Decisive output: defaultNamingContext and dnsHostName.

ldapsearch -x -LLL -H ldap://TARGET:389 -s base -b '' \
  defaultNamingContext rootDomainNamingContext configurationNamingContext dnsHostName

Convert DC=corp,DC=example into corp.example for DNS/Kerberos work. Preserve the server's exact hostname because Kerberos is name-sensitive.

LDAPS and certificate-name inspection 
openssl s_client -connect TARGET:636 -servername DC_HOST </dev/null
ldapsearch -x -LLL -H ldaps://DC_HOST:636 -s base -b '' defaultNamingContext dnsHostName

A certificate can disclose domain/DC names. A TLS validation error is a client trust/name issue, not proof that LDAP is unavailable.

Prerequisite: known base DN and server permitting anonymous search. Failure cue: Inappropriate authentication or Insufficient access closes only the anonymous path.

ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName memberOf description

ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
  '(objectClass=group)' cn member description

Prerequisite: a valid directory identity. Decisive output: objects/attributes unavailable anonymously. Avoid placing a real password in shell history when an interactive prompt is available.

ldapsearch -x -LLL -H ldap://DC_HOST:389 \
  -D 'USER@DOMAIN.TLD' -W -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName memberOf description servicePrincipalName userAccountControl
Search computers, groups and SPN-bearing accounts separately 
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=computer)' \
  dNSHostName operatingSystem operatingSystemVersion servicePrincipalName

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=group)' cn member

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(&(objectCategory=person)(servicePrincipalName=*))' \
  sAMAccountName servicePrincipalName memberOf

Kerberos prerequisites before an attack

Kerberos failures are often name/time/route failures rather than credential failures. Establish:

getent hosts DC_HOST
nc -nvz DC_IP 88
date -u
nmap -Pn -sV -p 88,389,445,464,636,3268,3269 DC_IP -oN dc-services.txt

Interpretation: resolve DOMAIN and DC_HOST consistently, keep clock skew within Kerberos tolerance, and ensure the KDC is reached through the selected route. KDC_ERR_C_PRINCIPAL_UNKNOWN points to identity/domain naming; KRB_AP_ERR_SKEW points to time; KDC_ERR_PREAUTH_FAILED normally points to authentication material.

Handoff

Sources