37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.4 LDAP Enumeration
LDAP (Lightweight Directory Access Protocol) – directory service (users, groups, computers). Port 389 (LDAP) / 636 (LDAPS). Active Directory LDAP var chalte – deep AD enum Chapter 38 (Impacket, BloodHound).
Basics against OpenLDAP / lab directory (jar Metasploitable kiwa tumcha OpenLDAP lab asel):
sudo apt install -y ldap-utils
# Anonymous bind attempt (lab) – should FAIL on hardened servers
ldapsearch -x -H ldap://192.168.56.20 -b "dc=lab,dc=local" -s base
ldapsearch -x -H ldap://192.168.56.20 -D "" -w "" -b "dc=lab,dc=local"
Anonymous bind risk: konihi credentials shivay directory read – usernames, emails, group membership. Production madhe anonymous bind disable; LDAPS; least-privilege bind accounts; network ACL.
Metasploitable 2 var full AD nahi – mhanun ithe concepts + commands; Windows AD lab setup Chapter 38 madhe. Samjla ka?
Ravindra Bagale's Tip
Students get scared by ldapsearch syntax (-b, -D, -x). The Base DN (dc=lab,dc=local) is the root path of the directory – the domain parts. First look at the root attributes with -s base, then search deeper. AD tools come later – get the idea clear first.
Ravindra Bagale's Tip – मराठी
Students ldapsearch syntax बघून घाबरतात (-b, -D, -x). Base DN (dc=lab,dc=local) हा directory चा root path आहे – domain चे भाग. आधी -s base ने root attributes बघा, मग deeper search. AD tools पुढे – आधी idea clear ठेवा.
Ravindra Bagale's Tip – हिंदी
Students ldapsearch syntax देखकर घबरा जाते हैं (-b, -D, -x). Base DN (dc=lab,dc=local) directory का root path है – domain के हिस्से. पहले -s base से root attributes देखो, फिर deeper search. AD tools आगे – पहले idea clear रखो.
Lab
Kali var ldapsearch -h vacha. Jar tumchya lab madhe OpenLDAP/AD nahi, tar notes madhe liha: (1) anonymous bind kay aahe, (2) LDAPS vs LDAP, (3) Chapter 38 madhe Impacket ne kay try karu. Jar LDAP port open asel (nmap -p 389,636 192.168.56.20) tar base query try kara – fail/success note kara.