LDAP Credential Extraction – LAPS gMSA and Hidden Passwords

With valid domain credentials and sufficient LDAP read access, several high-value credential stores are directly readable from Active Directory via LDAP queries. LAPS stores local administrator passwords in ms-MCS-AdmPwd. Group Managed Service Account passwords live in msDS-ManagedPassword. Administrators routinely leave plaintext passwords in description, info, and comment fields. None of these require elevated privileges to read if the ACLs are misconfigured — and they frequently are.

LAPS Password Extraction

LAPS (Local Administrator Password Solution) stores auto-rotated local admin passwords in the ms-MCS-AdmPwd attribute on each computer object. By default only specific groups can read it, but over-permissioned ACLs on computer OUs are common.

Check which computers have LAPS enabled and attempt to read the password:

Any computer returning a value in ms-MCS-AdmPwd gives you the current local admin password for that host.

With nxc:

With windapsearch:

Take any LAPS password returned and immediately test it for local admin access:

gMSA Password Extraction

Group Managed Service Accounts store their current password blob in msDS-ManagedPassword. Only accounts explicitly listed in msDS-GroupMSAMembership can read it, but that ACL is often misconfigured or you may already be operating as an account with read access.

The msDS-ManagedPassword attribute returns a binary blob. Parse it with gMSADumper to extract the NT hash:

The NT hash can be used directly for Pass-the-Hash — see https://hackindex.io/services/smb/exploitation/pass-the-hash.

Password in Description and Info Fields

Administrators frequently store passwords in user and computer object description fields. This is readable by all authenticated domain users by default.

Broader sweep across all objects and attributes that might contain credentials:

Any credential found here is valid domain account data — test it immediately across SMB, WinRM, and RDP.

Kerberoastable and AS-REP Roastable Account Extraction

With valid credentials, pull accounts configured for attack directly:

Kerberoastable accounts (have SPNs set):

AS-REP roastable accounts (pre-auth disabled):

Feed these directly into Impacket — see https://hackindex.io/services/kerberos/exploitation/kerberoasting and https://hackindex.io/services/kerberos/exploitation/asrep-roasting.

ACL-Based Readable Sensitive Attributes

Some environments misconfigure ACLs to allow standard users to read attributes that should be restricted. Check for readable unicodePwd, userPassword, or unixUserPassword attributes — rare on AD but common on OpenLDAP mixed environments:

On OpenLDAP, passwords may be returned in cleartext or as weak hashes ({MD5}, {SHA}, {CRYPT}). Extract and crack with hashcat.

Using nxc for Bulk Extraction