> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/ldap-389-636-3268-3269/ldapsearch-attack.md).

# ldapsearch 枚举

> 该 **ldapsearch** 该工具允许你查询 LDAP 服务器，以检索有关域结构、用户、组以及目录中存储的其他对象的信息。它对于 Active Directory 环境中的枚举尤其有用。

### **获取命名上下文**

此命令获取 **命名上下文** （LDAP 根），它们是探索域结构的入口点：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -s base namingcontexts
```

```bash
ldapsearch -x -H ldap://10.10.10.175 -s base namingcontexts
```

* `-x`：使用简单（匿名）身份验证。
* `-H ldap://10.10.10.175`：指定 LDAP 协议和目标服务器的 IP 地址。
* `-s base`：将搜索限制为域根。
* `命名上下文`：请求显示可用根的属性。

<figure><img src="/files/9134e0748347a237ba8abc7de0a49c51a5dc092a" alt=""><figcaption></figcaption></figure>

### **域结构分析**

此命令探索 LDAP 结构以识别用户、组或其他对象：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -b '<BASE_DN>'
```

```bash
ldapsearch -x -H ldap://10.10.10.175 -b 'DC=EGOTISTICAL-BANK,DC=LOCAL
```

* `-b 'DC=EGOTISTICAL-BANK,DC=LOCAL'`：定义搜索基准（LDAP 入口点）。
* 此命令返回当前权限可访问的所有信息。

### **筛选用户**

要仅提取域用户，请使用以下附加过滤： `grep` 和 `sed`:

```bash
ldapsearch -x -H ldap://<SERVER_IP> -b '<BASE_DN>' "(objectClass=user)" | grep "dn: CN=" | sed 's/dn: CN=//;s/,.*//'
```

```bash
ldapsearch -x -H ldap://10.10.10.175 -b 'DC=EGOTISTICAL-BANK,DC=LOCAL' | grep "dn: CN=" | sed 's/dn: CN=//;s/,DC=EGOTISTICAL-BANK,DC=LOCAL//'
```

* `grep "dn: CN="`：过滤包含用户通用名称（CN）的行。
* `sed`：清理结果，只显示用户名。

<div data-full-width="true"><figure><img src="/files/24555d056ef79f12c07218c97fe647b715d3a58b" alt=""><figcaption></figcaption></figure></div>

### **带身份验证的 LDAP 搜索**

此命令使用账户进行身份验证并查询 LDAP 服务器：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -D '<DOMAIN>/<USER>' -w '<PASSWORD>' -b '<BASE_DN>'
```

```bash
ldapsearch -x -H ldap://10.10.11.174 -D 'support.htb/ldap' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"
```

* `-D 'support.htb/ldap'`：指定用于身份验证的用户账户。
* `-w 'password'`：所用账户的密码。
* 此命令返回使用该账户可访问的所有数据。

### **搜索特定信息（高级筛选）**

要搜索特定信息，例如存储在字段中的密码，请应用额外过滤：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -D '<USER>@<DOMAIN>' -w '<PASSWORD>' -b '<BASE_DN>' | grep -i "<ATTRIBUTE>" -B <LINES_BEFORE>
```

```bash
ldapsearch -x -H ldap://10.10.11.174 -D 'ldap@support.htb' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=support,DC=htb" | grep -i "info:" -B 20
```

* `grep -i "info:"`：过滤包含以下内容的行 `信息` 属性，例如备注或密码。
* `-B 20`：在每个结果之前显示 20 行以提供上下文。

<figure><img src="/files/a24b7b117f0169e57ab6a46dca861cb51bea004b" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/ldap-389-636-3268-3269/ldapsearch-attack.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.