> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ldap-discovery/windapsearch.md).

# windapsearch

**windapsearch** is a Python script to help enumerate users, groups and computers from a Windows domain through LDAP queries. By default, Windows Domain Controllers support basic LDAP operations through port 389/tcp. With any valid domain account (regardless of privileges), it is possible to perform LDAP queries against a domain controller for any AD related information.

## Enumeration

{% hint style="info" %}
NOTE

Activate the virtual Python environment with `source ~/Python_venvs/windapsearch/bin/activate`
{% endhint %}

### User Enumeration

#### Unauthenticated user enumeration

```bash
windapsearch.py --dc-ip $TARGET_IP -U
```

<details>

<summary>Example usage</summary>

```bash
┌──(windapsearch)─(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Machines/Easy_Machines/Forest]
└─$ windapsearch.py --dc-ip $TARGET_IP -U
[+] No username provided. Will try anonymous bind.
[+] Using Domain Controller at: 10.129.95.210
[+] Getting defaultNamingContext from Root DSE
[+]     Found: DC=htb,DC=local
[+] Attempting bind
[+]     ...success! Binded as: 
[+]      None

[+] Enumerating all AD users
[+]     Found 28 users: 

cn: Guest

cn: DefaultAccount

cn: Exchange Online-ApplicationAccount
userPrincipalName: Exchange_Online-ApplicationAccount@htb.local

cn: SystemMailbox{1f05a927-89c0-4725-adca-4527114196a1}
userPrincipalName: SystemMailbox{1f05a927-89c0-4725-adca-4527114196a1}@htb.local

cn: SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}
userPrincipalName: SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}@htb.local

cn: SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}
userPrincipalName: SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}@htb.local

cn: DiscoverySearchMailbox {D919BA05-46A6-415f-80AD-7E09334BB852}
userPrincipalName: DiscoverySearchMailbox {D919BA05-46A6-415f-80AD-7E09334BB852}@htb.local

cn: Migration.8f3e7716-2011-43e4-96b1-aba62d229136
userPrincipalName: Migration.8f3e7716-2011-43e4-96b1-aba62d229136@htb.local

cn: FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042
userPrincipalName: FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@htb.local

cn: SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}
userPrincipalName: SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@htb.local

cn: SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA}
userPrincipalName: SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA}@htb.local

cn: SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9}
userPrincipalName: SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9}@htb.local

cn: HealthMailboxc3d7722415ad41a5b19e3e00e165edbe
userPrincipalName: HealthMailboxc3d7722415ad41a5b19e3e00e165edbe@htb.local

cn: HealthMailboxfc9daad117b84fe08b081886bd8a5a50
userPrincipalName: HealthMailboxfc9daad117b84fe08b081886bd8a5a50@htb.local

cn: HealthMailboxc0a90c97d4994429b15003d6a518f3f5
userPrincipalName: HealthMailboxc0a90c97d4994429b15003d6a518f3f5@htb.local

cn: HealthMailbox670628ec4dd64321acfdf6e67db3a2d8
userPrincipalName: HealthMailbox670628ec4dd64321acfdf6e67db3a2d8@htb.local

cn: HealthMailbox968e74dd3edb414cb4018376e7dd95ba
userPrincipalName: HealthMailbox968e74dd3edb414cb4018376e7dd95ba@htb.local

cn: HealthMailbox6ded67848a234577a1756e072081d01f
userPrincipalName: HealthMailbox6ded67848a234577a1756e072081d01f@htb.local

cn: HealthMailbox83d6781be36b4bbf8893b03c2ee379ab
userPrincipalName: HealthMailbox83d6781be36b4bbf8893b03c2ee379ab@htb.local

cn: HealthMailboxfd87238e536e49e08738480d300e3772
userPrincipalName: HealthMailboxfd87238e536e49e08738480d300e3772@htb.local

cn: HealthMailboxb01ac647a64648d2a5fa21df27058a24
userPrincipalName: HealthMailboxb01ac647a64648d2a5fa21df27058a24@htb.local

cn: HealthMailbox7108a4e350f84b32a7a90d8e718f78cf
userPrincipalName: HealthMailbox7108a4e350f84b32a7a90d8e718f78cf@htb.local

cn: HealthMailbox0659cc188f4c4f9f978f6c2142c4181e
userPrincipalName: HealthMailbox0659cc188f4c4f9f978f6c2142c4181e@htb.local

cn: Sebastien Caron
userPrincipalName: sebastien@htb.local

cn: Lucinda Berger
userPrincipalName: lucinda@htb.local

cn: Andy Hislip
userPrincipalName: andy@htb.local

cn: Mark Brandt
userPrincipalName: mark@htb.local

cn: Santi Rodriguez
userPrincipalName: santi@htb.local


[*] Bye!

```

</details>

#### Authenticated user enumeration

```bash
windapsearch.py --dc-ip $TARGET_IP -u '<user>' -p '<password>' -U
```

### Group Enumeration

#### Unauthenticated group enumeration

```bash
windapsearch.py --dc-ip $TARGET_IP -G
```

<details>

<summary>Example usage</summary>

```bash
┌──(windapsearch)─(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Machines/Easy_Machines/Forest]
└─$ windapsearch.py --dc-ip $TARGET_IP -G
[+] No username provided. Will try anonymous bind.
[+] Using Domain Controller at: 10.129.95.210
[+] Getting defaultNamingContext from Root DSE
[+]     Found: DC=htb,DC=local
[+] Attempting bind
[+]     ...success! Binded as: 
[+]      None

[+] Enumerating all AD groups
[+]     Found 59 groups: 

cn: Users
distinguishedName: CN=Users,CN=Builtin,DC=htb,DC=local

cn: Guests
distinguishedName: CN=Guests,CN=Builtin,DC=htb,DC=local

cn: Remote Desktop Users
distinguishedName: CN=Remote Desktop Users,CN=Builtin,DC=htb,DC=local

cn: Network Configuration Operators
distinguishedName: CN=Network Configuration Operators,CN=Builtin,DC=htb,DC=local

cn: Performance Monitor Users
distinguishedName: CN=Performance Monitor Users,CN=Builtin,DC=htb,DC=local

cn: Performance Log Users
distinguishedName: CN=Performance Log Users,CN=Builtin,DC=htb,DC=local

cn: Distributed COM Users
distinguishedName: CN=Distributed COM Users,CN=Builtin,DC=htb,DC=local

cn: IIS_IUSRS
distinguishedName: CN=IIS_IUSRS,CN=Builtin,DC=htb,DC=local

cn: Cryptographic Operators
distinguishedName: CN=Cryptographic Operators,CN=Builtin,DC=htb,DC=local

cn: Event Log Readers
distinguishedName: CN=Event Log Readers,CN=Builtin,DC=htb,DC=local

cn: Certificate Service DCOM Access
distinguishedName: CN=Certificate Service DCOM Access,CN=Builtin,DC=htb,DC=local

cn: RDS Remote Access Servers
distinguishedName: CN=RDS Remote Access Servers,CN=Builtin,DC=htb,DC=local

cn: RDS Endpoint Servers
distinguishedName: CN=RDS Endpoint Servers,CN=Builtin,DC=htb,DC=local

cn: RDS Management Servers
distinguishedName: CN=RDS Management Servers,CN=Builtin,DC=htb,DC=local

cn: Hyper-V Administrators
distinguishedName: CN=Hyper-V Administrators,CN=Builtin,DC=htb,DC=local

cn: Access Control Assistance Operators
distinguishedName: CN=Access Control Assistance Operators,CN=Builtin,DC=htb,DC=local

cn: Remote Management Users
distinguishedName: CN=Remote Management Users,CN=Builtin,DC=htb,DC=local

cn: System Managed Accounts Group
distinguishedName: CN=System Managed Accounts Group,CN=Builtin,DC=htb,DC=local

cn: Storage Replica Administrators
distinguishedName: CN=Storage Replica Administrators,CN=Builtin,DC=htb,DC=local

cn: Domain Computers
distinguishedName: CN=Domain Computers,CN=Users,DC=htb,DC=local

cn: Cert Publishers
distinguishedName: CN=Cert Publishers,CN=Users,DC=htb,DC=local

cn: Domain Users
distinguishedName: CN=Domain Users,CN=Users,DC=htb,DC=local

cn: Domain Guests
distinguishedName: CN=Domain Guests,CN=Users,DC=htb,DC=local

cn: Group Policy Creator Owners
distinguishedName: CN=Group Policy Creator Owners,CN=Users,DC=htb,DC=local

cn: RAS and IAS Servers
distinguishedName: CN=RAS and IAS Servers,CN=Users,DC=htb,DC=local

cn: Pre-Windows 2000 Compatible Access
distinguishedName: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=htb,DC=local

cn: Incoming Forest Trust Builders
distinguishedName: CN=Incoming Forest Trust Builders,CN=Builtin,DC=htb,DC=local

cn: Windows Authorization Access Group
distinguishedName: CN=Windows Authorization Access Group,CN=Builtin,DC=htb,DC=local

cn: Terminal Server License Servers
distinguishedName: CN=Terminal Server License Servers,CN=Builtin,DC=htb,DC=local

cn: Allowed RODC Password Replication Group
distinguishedName: CN=Allowed RODC Password Replication Group,CN=Users,DC=htb,DC=local

cn: Denied RODC Password Replication Group
distinguishedName: CN=Denied RODC Password Replication Group,CN=Users,DC=htb,DC=local

cn: Enterprise Read-only Domain Controllers
distinguishedName: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=htb,DC=local

cn: Cloneable Domain Controllers
distinguishedName: CN=Cloneable Domain Controllers,CN=Users,DC=htb,DC=local

cn: Protected Users
distinguishedName: CN=Protected Users,CN=Users,DC=htb,DC=local

cn: Key Admins
distinguishedName: CN=Key Admins,CN=Users,DC=htb,DC=local

cn: Enterprise Key Admins
distinguishedName: CN=Enterprise Key Admins,CN=Users,DC=htb,DC=local

cn: DnsAdmins
distinguishedName: CN=DnsAdmins,CN=Users,DC=htb,DC=local

cn: DnsUpdateProxy
distinguishedName: CN=DnsUpdateProxy,CN=Users,DC=htb,DC=local

cn: Organization Management
distinguishedName: CN=Organization Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Recipient Management
distinguishedName: CN=Recipient Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: View-Only Organization Management
distinguishedName: CN=View-Only Organization Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Public Folder Management
distinguishedName: CN=Public Folder Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: UM Management
distinguishedName: CN=UM Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Help Desk
distinguishedName: CN=Help Desk,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Records Management
distinguishedName: CN=Records Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Discovery Management
distinguishedName: CN=Discovery Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Server Management
distinguishedName: CN=Server Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Delegated Setup
distinguishedName: CN=Delegated Setup,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Hygiene Management
distinguishedName: CN=Hygiene Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Compliance Management
distinguishedName: CN=Compliance Management,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Security Reader
distinguishedName: CN=Security Reader,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Security Administrator
distinguishedName: CN=Security Administrator,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Exchange Servers
distinguishedName: CN=Exchange Servers,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Exchange Trusted Subsystem
distinguishedName: CN=Exchange Trusted Subsystem,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Managed Availability Servers
distinguishedName: CN=Managed Availability Servers,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Exchange Windows Permissions
distinguishedName: CN=Exchange Windows Permissions,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: ExchangeLegacyInterop
distinguishedName: CN=ExchangeLegacyInterop,OU=Microsoft Exchange Security Groups,DC=htb,DC=local

cn: Exchange Install Domain Servers
distinguishedName: CN=Exchange Install Domain Servers,CN=Microsoft Exchange System Objects,DC=htb,DC=local

cn: test
distinguishedName: CN=test,OU=Security Groups,DC=htb,DC=local


[*] Bye!

```

</details>

#### Authenticated group enumeration

```bash
windapsearch.py --dc-ip $TARGET_IP -u '<user>' -p '<password>' -G
```

### Computer Enumeration

#### Unauthenticated computer enumeration

```bash
windapsearch.py --dc-ip $TARGET_IP -C
```

#### Authenticated computer enumeration

```bash
windapsearch.py --dc-ip $TARGET_IP -u '<user>' -p '<password>' -C
```

## Usage information

<details>

<summary>windapsearch.py -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ source ~/Python_venvs/windapsearch/bin/activate
                                                                                                                                                                                                                               
┌──(windapsearch)─(kali㉿kali)-[~]
└─$ windapsearch.py -h
usage: windapsearch.py [-h] [-d DOMAIN] [--dc-ip DC_IP] [-u USER] [-p PASSWORD] [--functionality] [-G] [-U] [-PU] [-C] [-m GROUP_NAME] [--da] [--admin-objects] [--user-spns] [--unconstrained-users]
                       [--unconstrained-computers] [--gpos] [-s SEARCH_TERM] [-l DN] [--custom CUSTOM_FILTER] [-r] [--attrs ATTRS] [--full] [-o output_dir]

Script to perform Windows domain enumeration through LDAP queries to a Domain Controller

options:
  -h, --help            show this help message and exit

Domain Options:
  -d, --domain DOMAIN   The FQDN of the domain (e.g. 'lab.example.com'). Only needed if DC-IP not provided
  --dc-ip DC_IP         The IP address of a domain controller

Bind Options:
  Specify bind account. If not specified, anonymous bind will be attempted

  -u, --user USER       The full username with domain to bind with (e.g. 'ropnop@lab.example.com' or 'LAB\ropnop'
  -p, --password PASSWORD
                        Password to use. If not specified, will be prompted for

Enumeration Options:
  Data to enumerate from LDAP

  --functionality       Enumerate Domain Functionality level. Possible through anonymous bind
  -G, --groups          Enumerate all AD Groups
  -U, --users           Enumerate all AD Users
  -PU, --privileged-users
                        Enumerate All privileged AD Users. Performs recursive lookups for nested members.
  -C, --computers       Enumerate all AD Computers
  -m, --members GROUP_NAME
                        Enumerate all members of a group
  --da                  Shortcut for enumerate all members of group 'Domain Admins'. Performs recursive lookups for nested members.
  --admin-objects       Enumerate all objects with protected ACLs (i.e. admins)
  --user-spns           Enumerate all users objects with Service Principal Names (for kerberoasting)
  --unconstrained-users
                        Enumerate all user objects with unconstrained delegation
  --unconstrained-computers
                        Enumerate all computer objects with unconstrained delegation
  --gpos                Enumerate Group Policy Objects
  -s, --search SEARCH_TERM
                        Fuzzy search for all matching LDAP entries
  -l, --lookup DN       Search through LDAP and lookup entry. Works with fuzzy search. Defaults to printing all attributes, but honors '--attrs'
  --custom CUSTOM_FILTER
                        Perform a search with a custom object filter. Must be valid LDAP filter syntax

Output Options:
  Display and output options for results

  -r, --resolve         Resolve IP addresses for enumerated computer names. Will make DNS queries against system NS
  --attrs ATTRS         Comma separated custom atrribute names to search for (e.g. 'badPwdCount,lastLogon')
  --full                Dump all atrributes from LDAP.
  -o, --output output_dir
                        Save results to TSV files in <OUTPUT_DIR>

```

</details>

## Resources

Windapsearch - GitHub: <https://github.com/ropnop/windapsearch>