// notes/ Active Directory
🏛️
Post Compromise Enumeration Ldapdomaindump
Ldapdomaindump works by connecting to the LDAP server/Domain Controller, and querying it for information about users, groups, etc. It takes the responses from the server and puts…
#active directory#adot8
source · oscp.adot8.com · active-directory/post-compromise-enumeration_ldapdomaindump ↗Ldapdomaindump
Overview
Ldapdomaindump works by connecting to the LDAP server/Domain Controller, and querying it for information about users, groups, etc. It takes the responses from the server and puts it into a nice readable format for us to read.
Impacket-ntlmrelayx uses this tool by automatically default but if the IPv6 DNS Takeover attack didn't work there is a manual way of doing it.
Domain Enumeration
bash
$sudo ldapdomaindump ldap://192.168.1.129 -u 'PNPT\greg' -p 'Password1'