> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/ldap-389-636-3268-3269/ldapsearch-attack.md).

# ldapsearch 枚举

使用 ldapsearch 进行 LDAP 枚举，涵盖命名上下文、域对象、用户、组和敏感属性。

> 该 **ldapsearch** 该工具允许你查询 LDAP 服务器，以检索有关域结构、用户、组以及目录中存储的其他对象的信息。它在 Active Directory 环境中的枚举中尤其有用。

### **获取命名上下文**

此命令获取 **命名上下文** （LDAP 根），它们是探索域结构的入口点：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -s base namingcontexts
```

```bash
ldapsearch -x -H ldap://10.10.10.175 -s base namingcontexts
```

* `-x`：使用简单（匿名）认证。
* `-H ldap://10.10.10.175`：指定 LDAP 协议和目标服务器的 IP 地址。
* `-s base`：将搜索限制在域的根。
* `namingcontexts`：请求显示可用根的属性。

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-7693fc0d7faa3efcfec825d3530ac90ba336e39d%2Fimage%20(1595).png?alt=media" alt=""><figcaption></figcaption></figure>

### **域结构分析**

此命令会探索 LDAP 结构，以识别用户、组或其他对象：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -b '<BASE_DN>'
```

```bash
ldapsearch -x -H ldap://10.10.10.175 -b 'DC=EGOTISTICAL-BANK,DC=LOCAL
```

* `-b 'DC=EGOTISTICAL-BANK,DC=LOCAL'`：定义搜索基准（LDAP 入口点）。
* 此命令会返回当前权限可访问的所有信息。

### **筛选用户**

要仅提取域用户，可使用以下方式进行额外过滤： `grep` 和 `sed`:

```bash
ldapsearch -x -H ldap://<SERVER_IP> -b '<BASE_DN>' "(objectClass=user)" | grep "dn: CN=" | sed 's/dn: CN=//;s/,.*//'
```

```bash
ldapsearch -x -H ldap://10.10.11.174 -b 'DC=EGOTISTICAL-BANK,DC=LOCAL' | grep "dn: CN=" | sed 's/dn: CN=//;s/,DC=EGOTISTICAL-BANK,DC=LOCAL//'
```

* `grep "dn: CN="`：过滤包含用户通用名称（CN）的行。
* `sed`：清理结果，仅显示用户名。

<div data-full-width="true"><figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-fc5fbff793904922b072c824e04af25214a0ea04%2Fimage%20(1596).png?alt=media" alt=""><figcaption></figcaption></figure></div>

### **带身份验证的 LDAP 搜索**

此命令使用账户进行身份验证并查询 LDAP 服务器：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -D '<DOMAIN>/<USER>' -w '<PASSWORD>' -b '<BASE_DN>'
```

```bash
ldapsearch -x -H ldap://10.10.11.174 -D 'support.htb/ldap' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"
```

* `-D 'support.htb/ldap'`：指定用于身份验证的用户账户。
* `-w 'password'`：所用账户的密码。
* 此命令会返回此账户可访问的所有数据。

### **搜索特定信息（高级过滤）**

要搜索特定信息，例如存储在字段中的密码，请应用额外过滤：

```bash
ldapsearch -x -H ldap://<SERVER_IP> -D '<USER>@<DOMAIN>' -w '<PASSWORD>' -b '<BASE_DN>' | grep -i "<ATTRIBUTE>" -B <LINES_BEFORE>
```

```bash
ldapsearch -x -H ldap://10.10.11.174 -D 'ldap@support.htb' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=support,DC=htb" | grep -i "info:" -B 20
```

* `grep -i "info:"`：过滤包含 `info` 属性的行，例如备注或密码。
* `-B 20`：在每个结果之前显示 20 行以提供上下文。

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-66d7b358420350e9c73aef45179ffd790a85cffc%2Fimage%20(1547).png?alt=media" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/ldap-389-636-3268-3269/ldapsearch-attack.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.