ldap.cheat

% LDAP Enum

$ domain: { [ -f scope.txt ] && tr '[:space:]' '\n' < scope.txt | sed '/^$/d'; printf '%s\n' example.com; } | sort -u
$ ip: { [ -f scope.txt ] && tr '[:space:]' '\n' < scope.txt | sed '/^$/d'; printf '%s\n' 127.0.0.1; } | sort -u

# ldap search all objectclasses
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ openldap ]' -c ldapsearch -LLL -x -H ldap://<domain> -b '' -s base '(objectclass=*)'

# ldap search with correct dc and enumerate all entries
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ openldap ]' -c ldapsearch -x -b "$(ldapsearch -LLL -x -H ldap://<ip> -b '' -s base '(objectclass=*)' | grep rootDomainNamingContext | cut -d " " -f 2)" "*" -h <ip> | tee ldapsearch.out