Skip to content
HackIndex logo

HackIndex

LDAP Signing and Channel Binding

3 min read May 15, 2026

LDAP signing protects LDAP connections from tampering and relay attacks by requiring clients to sign their requests. When it is not enforced, NTLM authentication can be relayed to the LDAP service to create accounts, modify ACLs, and escalate privileges — without any existing credentials. LDAPS channel binding is a separate control that prevents relaying to the encrypted LDAPS endpoint. Both are disabled by default in many environments. This page confirms the vulnerability — exploitation via relay is covered in LDAP Relay and Signing Abuse.

Check signing and channel binding status

┌──(kali㉿kali)-[~]
└─$ # Primary check — ldap-checker module
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker
 
# With null auth if anonymous bind is available
nxc ldap $TARGET_IP -u '' -p '' -M ldap-checker 
LDAP  10.10.10.10  389  DC01  [*] Additional checks
LDAP  10.10.10.10  389  DC01  LDAP signing NOT enforced (vulnerable to relay)
LDAP  10.10.10.10  389  DC01  LDAPS channel binding NOT required (vulnerable to relay over LDAPS)

Manual confirmation via registry read

The signing requirement is controlled by a registry value on the domain controller. If you have any read access to the DC — via SMB, WMI, or RPC — you can read it directly.

┌──(kali㉿kali)-[~]
└─$ # Via nxc SMB registry read
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --reg-query "HKLM\System\CurrentControlSet\Services\NTDS\Parameters" --reg-key "LDAPServerIntegrity"
 
┌──(kali㉿kali)-[~]
└─$ # Via impacket reg.py
┌──(kali㉿kali)-[~]
└─$ impacket-reg $DOMAIN/$USER:$PASSWORD@$TARGET_IP query -keyName "HKLM\System\CurrentControlSet\Services\NTDS\Parameters" -v LDAPServerIntegrity 
LDAPServerIntegrity  REG_DWORD  0x1
# 0 = None (signing disabled — vulnerable)
# 1 = Negotiate signing (signing optional — still vulnerable)
# 2 = Require signing (enforced — not vulnerable to unsigned relay)

Value 0x1 (Negotiate signing) means the DC will accept both signed and unsigned connections — relay attacks still work. Only 0x2 (Require signing) blocks relay. The channel binding equivalent is LdapEnforceChannelBinding — value 0 or 1 is vulnerable, value 2 is protected.

Verify relay is possible — attempt unsigned bind

Directly test whether the DC accepts an unsigned LDAP connection. If it does, relay will work.

┌──(kali㉿kali)-[~]
└─$ # Attempt a simple unsigned bind — if it succeeds, relay is viable
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -s base "(objectClass=*)" 2>&1 | grep -E "result:|success"
 
┌──(kali㉿kali)-[~]
└─$ # Python check — explicit unsigned LDAP connection
┌──(kali㉿kali)-[~]
└─$ python3 -c "
import ldap3
server = ldap3.Server('$TARGET_IP', get_info=ldap3.ALL)
conn = ldap3.Connection(server, '$USER@$DOMAIN', '$PASSWORD', authentication=ldap3.NTLM)
result = conn.bind()
print('Unsigned bind:', result)
print('Server info:', server.info.other.get('supportedLDAPVersion', 'unknown'))
"

Check prerequisites for relay exploitation

Before investing time in relay setup, verify all prerequisites are met.

┌──(kali㉿kali)-[~]
└─$ # 1 — LDAP signing not enforced (confirmed above)
 
┌──(kali㉿kali)-[~]
└─$ # 2 — Machine Account Quota > 0 (needed for RBCD path)
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M maq
 
┌──(kali㉿kali)-[~]
└─$ # 3 — Can you coerce authentication?
┌──(kali㉿kali)-[~]
└─$ # Check if print spooler is running (enables printerbug coercion)
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spooler
 
┌──(kali㉿kali)-[~]
└─$ # Check if WebDAV is running (enables coercion via HTTP)
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M webdav
 
┌──(kali㉿kali)-[~]
└─$ # 4 — SMB signing on potential coercion targets
┌──(kali㉿kali)-[~]
└─$ nxc smb 192.168.1.0/24 --gen-relay-list relay_targets.txt

Impact

  • LDAP signing not enforced + ability to coerce auth → create machine account in domain, set up RBCD, impersonate any user including Domain Admin — see AD Coercion Attacks for coercion methods and NTLM Relay Conditions for prerequisites

  • LDAP signing not enforced + relay high-privilege account → grant DCSync rights to controlled account, dump all domain hashes

  • LDAPS channel binding not required → same attacks work against port 636

When all prerequisites are confirmed, proceed to LDAP Relay and Signing Abuse.

References