ldeep

ldeep is an in-depth LDAP enumeration utility that ships dozens of focused subcommands (users, groups, memberships, trusts, GPOs, delegation, PSOs, and more) under its ldap mode. The all subcommand collects computers, domain_policy, zones, gpo, groups, ou, users, trusts and pso in one pass and writes each to files prefixed with the base name you supply. Run it with any valid domain account when you want a complete, structured snapshot of the directory to grep offline. Individual subcommands (e.g. ldeep ldap ... trusts) can be run afterward for targeted queries. Command Reference: Username: john Password: password123 Domain: test.local Target DC IP: 10.10.10.1

# Collect everything into files prefixed 'output' (output_users.json, output_groups.json, ...)
ldeep ldap -u john -p password123 -d test.local -s ldap://10.10.10.1 all output

Native

Enumeration, Discovery

MITRE

T1087.002

Requires

Username, Password

Services

LDAP

Refs

github.com/franc-pentest/ldeep

www.hackingarticles.in/active-directory-enumeration-ldeep/

attack.mitre.org/techniques/T1087/002/