← Back to Academy

Academy Node

LDAP Enumeration

LDAP enumeration pulls users, groups, computers, SPNs, UAC flags, ACLs, and domain metadata.

Beginner100 XPEnumeration

Why it matters

LDAP is how you discover roastable users, group paths, and AD structure.

How to identify it

  • Port 389 or 636 open
  • Valid domain creds or anonymous bind
  • Can query users/groups/computers

BloodHound indicators

  • User/group/computer object discovery

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --users
nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --groups

Linux commands

ldapsearch -x -H ldap://192.168.184.141 -b 'DC=xutslabs,DC=local'
windapsearch -d xutslabs.local --dc-ip 192.168.184.141 -u ba_low -p 'Password123' --users

Expected output

  • User list
  • Group list
  • SPN users
  • userAccountControl flags

Success looks like

  • Find users
  • Find SPNs
  • Find preauth-disabled accounts
  • Find group memberships

Failure looks like

  • Invalid credentials
  • Operations error
  • Stronger auth required

Troubleshooting

  • Use -dc-ip
  • Fix DNS
  • Try LDAPS if required

Common mistakes

  • Not setting base DN correctly
  • Forgetting domain FQDN
  • Skipping LDAP after SMB works

Alternative attacks

  • BloodHound collection
  • Kerberos user enum

What to try next

  • Check ASREP
  • Check Kerberoast
  • Collect BloodHound
  • Check ADCS

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.