Quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by (ab)using LDAP Ping requests (cLDAP)
Quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by (ab)using LDAP Ping requests (cLDAP)
Looks for enabled normal user accounts. No Windows audit logs generated. High speed ~ up to 10K/sec - go beyond 25K/sec with multiple servers!
go install github.com/lkarlslund/ldapnomnom@latest
ldapnomnom [--server dc1.domain.suffix[,dc2.domain.suffix] | --dnsdomain domain.suffix] [--port number] [--tlsmode notls|tls|starttls] [--input filename] [--output filename] [--parallel number-of-connections] [--maxservers number-of-servers] [--maxstrategy fastest|random] [--throttle n] [--maxrequests n]
Connect to up to 32 servers from contoso.local with 16 connections to each - FAAAAAAAST
ldapnomnom --input 10m_usernames.txt --output multiservers.txt --dnsdomain contoso.local --maxservers 32 --parallel 16
Connect to one named server with 4 connections
ldapnomnom --input 10m_usernames.txt --output results.txt --server 192.168.0.11 --parallel 4
Look for username lists to feed into this elsewhere - for instance the 10M list from here
You can also use LDAP Nom Nom to dump attributes from the rootDSE object, by adding the "--dump" option.
Connect to all servers you can find, and output all readable attributes to JSON:
ldapnomnom --output rootDSEs.json --dump
During a discussion on Twitter about locating Kerberos services, someone hinted the existance of LDAP Ping requests. They're documented on Microsofts Open Specifications Pages, and it contains pseudo code for how you initiate a LDAP Ping, what parameters it takes and the data returned. It immediately seemed obvious that there is an information leak here that can be abused.
After having released the tool, I can see I'm not the only one to spot this "mistake" which is clearly still around for historic backwards compatibility reasons.
If you want to avoid network level detection as an attacker you should use TLS on port 636 (tool defaults to unencrypted LDAP on port 389).
If you like Active Directory you might also like my attack graph tool Adalanche