Querying the directory with LDAP: filters and attributes
You set up LDAP queries without putting your password on the command line, use equality, wildcard, presence and AND/OR/NOT filters and userAccountControl bit filters, choose where and how deep to search, and decode base64 values and Windows timestamps. At the end you list the enabled accounts whose password never expires and the computers not seen for 180 days on your own.
Level 201 · 50 min
The second week of the audit. The IT manager wants a list: "Which accounts have passwords that never expire, and which computers haven’t joined the network for months?" The answer to all of these is in the directory, that is, in Active Directory.
The language for asking the directory questions is LDAP (Lightweight Directory Access Protocol). Analogy: the directory is a huge card index, and an LDAP filter writes a request like "bring everyone in Accounting whose password never expires" in a form the machine understands. Attackers scan the directory this way first too; the defender’s advantage is asking the questions first.
In this lesson you set up a settings file and a protected password file so you don’t type your password in every query. In the first steps I give you the commands; in the last ones you only see the question.
Note: the domain controller takes about 20 seconds to get ready after the lab starts.
What you will do in this lesson
- Query settings and a protected password file
- Equality and wildcard: (sAMAccountName=svc.*)
- AND, OR, NOT: &, | and !
- Presence filters and counting
- Double-colon values: base64 -d
- Where and how deep: -b and -s
- Bit filters: 803 (all) and 804 (any)
- Decode Windows time: FILETIME
- Task: enabled accounts whose password never expires
- Task: computers not seen for 180 days
- Short quiz
Skills you will earn
- LDAP queries without the password on the command line (~/.ldaprc, -y)
- Writing equality and wildcard filters
- Combining LDAP filters with &, | and !
- Presence filters and counting objects
- Decoding base64 values in LDIF
- Choosing the search base and scope (-b, -s)
- Filtering userAccountControl bits with the 803/804 rules
- Converting Windows FILETIME values to dates
- Answering an audit question with a single LDAP query
← Authentication: Kerberos and NTLM · Active Directory security: auditing and hardening · Privileged groups: Domain Admins, Enterprise Admins, Backup Operators →
Start for free