Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 02. Protocols / LDAP / Enumeration

Domain Controllers

Domain controller discovery through LDAP identifies the machines that hold directory services and Kerberos authority. We use these results to pick reliable LDAP, Kerberos, SMB, DNS, and replication targets.

export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'

Domain controller computer objects:

ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' name dNSHostName operatingSystem servicePrincipalName userAccountControl

Domain controller SPNs:

ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(objectCategory=computer)(servicePrincipalName=LDAP/*))' name dNSHostName servicePrincipalName

Domain object and SID:

ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(objectClass=domain)' distinguishedName objectSid

DNS SRV lookup:

nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN $DC
nslookup -type=SRV _kerberos._tcp.dc._msdcs.$DOMAIN $DC

NetExec:

nxc ldap $DC -d OOTW -u $USER -p "$PASS" --dns
nxc smb $DC -d OOTW -u $USER -p "$PASS"

PowerShell:

Get-ADDomainController -Filter * | Select-Object HostName,Site,IPv4Address,OperatingSystem
Get-ADComputer -LDAPFilter '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' -Properties dNSHostName,servicePrincipalName