Group queries show who inherits access. We use LDAP to list groups, inspect membership, find privileged groups, locate nested relationships, and identify writable targets that matter for ACL abuse and lateral movement.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Pull all groups with membership and descriptive fields.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -E pr=1000/noprompt -o ldif-wrap=no -b "$BASE" '(samAccountType=268435456)' cn sAMAccountName distinguishedName description member groupType adminCount
Find protected groups and privileged objects marked by adminCount.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(adminCount=1)' cn sAMAccountName distinguishedName memberOf objectClass
Enumerate Domain Admins directly.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(cn=Domain Admins)' cn member memberOf adminCount
Find administrative, remote access, SQL, and operator-style groups by naming.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=268435456)(|(cn=*admin*)(cn=*operator*)(cn=*remote*)(cn=*sql*)(cn=*db*)(cn=*database*)(cn=*server*)(description=*admin*)))' cn distinguishedName description member
Confirm groups that directly contain a known user.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(member=CN=student,CN=Users,DC=ootw,DC=local)' cn distinguishedName
Expand nested group membership with the LDAP in-chain matching rule.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(member:1.2.840.113556.1.4.1941:=CN=student,CN=Users,DC=ootw,DC=local)' cn distinguishedName
Enumerate members of a specific group, including user and group objects.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(|(samAccountType=805306368)(samAccountType=268435456))(memberOf=CN=ACL Operators,OU=Groups,OU=OOTW Lab,DC=ootw,DC=local))' distinguishedName sAMAccountName cn
Fast wrapper enumeration with NetExec and windapsearch.
nxc ldap $DC -d OOTW -u $USER -p "$PASS" --groups
python3 windapsearch.py -d $DOMAIN -u $USER -p "$PASS" --groups
python3 windapsearch.py -d $DOMAIN -u $USER -p "$PASS" --da
Windows-side equivalent.
Get-ADGroup -LDAPFilter '(samAccountType=268435456)' -Properties Member,Description,AdminCount |
Select-Object Name,DistinguishedName,Description,AdminCount
Get-ADGroupMember 'Domain Admins' -Recursive