> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ldap-discovery/ldapdomaindump.md).

# ldapdomaindump

Active Directory information dumper via LDAP

**ldapdomaindump** is a tool which aims to solve this problem, by collecting and parsing information available via LDAP and outputting it in a human readable HTML format, as well as machine readable json and csv/tsv/greppable files.

The tool outputs several files containing an overview of objects in the domain:

* *domain\_groups*: List of groups in the domain
* *domain\_users*: List of users in the domain
* *domain\_computers*: List of computer accounts in the domain
* *domain\_policy*: Domain policy such as password requirements and lockout policy
* *domain\_trusts*: Incoming and outgoing domain trusts, and their properties

As well as two grouped files:

* *domain\_users\_by\_group*: Domain users per group they are member of
* *domain\_computers\_by\_os*: Domain computers sorted by Operating System

## Example usage

#### With credentials

Connect with a known username and password and store the resulting files in the `ldapdump` directory

```bash
ldapdomaindump -u 'spookysec.local\svc-admin' -p management2005 -o ldapdump $TARGET_IP
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Challenges/Medium/Attacktive_Directory]
└─$ ldapdomaindump -u 'spookysec.local\svc-admin' -p management2005 -o ldapdump $TARGET_IP
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished

```

</details>

#### Without credentials

Connect with an anonymous user and store the resulting files in the `ldapdump` directory

```bash
ldapdomaindump -o ldapdump $TARGET_IP
```

This will normally **fail**!

### Usage information

<details>

<summary>ldapdomaindump -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ ldapdomaindump -h
usage: ldapdomaindump [-h] [-u USERNAME] [-p PASSWORD] [-at {NTLM,SIMPLE}] [-o DIRECTORY] [--no-html] [--no-json] [--no-grep] [--grouped-json] [-d DELIMITER] [-r] [-n DNS_SERVER] [-m] HOSTNAME

Domain information dumper via LDAP. Dumps users/computers/groups and OS/membership information to HTML/JSON/greppable output.

Required options:
  HOSTNAME              Hostname/ip or ldap://host:port connection string to connect to (use ldaps:// to use SSL)

Main options:
  -h, --help            show this help message and exit
  -u, --user USERNAME   DOMAIN\username for authentication, leave empty for anonymous authentication
  -p, --password PASSWORD
                        Password or LM:NTLM hash, will prompt if not specified
  -at, --authtype {NTLM,SIMPLE}
                        Authentication type (NTLM or SIMPLE, default: NTLM)

Output options:
  -o, --outdir DIRECTORY
                        Directory in which the dump will be saved (default: current)
  --no-html             Disable HTML output
  --no-json             Disable JSON output
  --no-grep             Disable Greppable output
  --grouped-json        Also write json files for grouped files (default: disabled)
  -d, --delimiter DELIMITER
                        Field delimiter for greppable output (default: tab)

Misc options:
  -r, --resolve         Resolve computer hostnames (might take a while and cause high traffic on large networks)
  -n, --dns-server DNS_SERVER
                        Use custom DNS resolver instead of system DNS (try a domain controller IP)
  -m, --minimal         Only query minimal set of attributes to limit memmory usage

```

</details>

## Resources

LDAPDomainDump - GitHub: <https://github.com/dirkjanm/ldapdomaindump>

ldapdomaindump - Kali Tools: <https://www.kali.org/tools/python-ldapdomaindump/#ldapdomaindump>