LDAPWordlistHarvester: generate a wordlist from the information present in LDAP

by do son · December 13, 2023

LDAPWordlistHarvester

A tool to generate a wordlist from the information present in LDAP, in order to crack non-random passwords of domain accounts.

Features

The bigger the domain is, the better the wordlist will be.

Creates a wordlist based on the following information found in the LDAP:
- User: name and sAMAccountName
- Computer: name and sAMAccountName
- Groups: name
- Organizational Units: name
- Active Directory Sites: name and descriptions
- All LDAP objects: descriptions
Choose a wordlist output file name with an option –outputfile

Install

git clone https://github.com/p0dalirius/LDAPWordlistHarvester.git
cd LDAPWordlistHarvester
pip install -r requirements.txt

Use

$ ./LDAPWordlistHarvester.py -h
LDAPWordlistHarvester.py v1.1 - by @podalirius_

usage: LDAPWordlistHarvester.py [-h] [-v] [-o OUTPUTFILE] --dc-ip ip address [-d DOMAIN] [-u USER] [--no-pass | -p PASSWORD | -H [LMHASH:]NTHASH | --aes-key hex key] [-k]

options:
  -h, --help            show this help message and exit
  -v, --verbose         Verbose mode. (default: False)
  -o OUTPUTFILE, --outputfile OUTPUTFILE
                        Path to output file of wordlist.

Authentication & connection:
  --dc-ip ip address    IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameter
  -d DOMAIN, --domain DOMAIN
                        (FQDN) domain to authenticate to
  -u USER, --user USER  user to authenticate with

Credentials:
  --no-pass             Don't ask for password (useful for -k)
  -p PASSWORD, --password PASSWORD
                        Password to authenticate with
  -H [LMHASH:]NTHASH, --hashes [LMHASH:]NTHASH
                        NT/LM hashes, format is LMhash:NThash
  --aes-key hex key     AES key to use for Kerberos Authentication (128 or 256 bits)
  -k, --kerberos        Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line

Demonstration

To generate a wordlist from the LDAP of the domain domain.local you can use this command:

./LDAPWordlistHarvester.py -d ‘domain.local’ -u ‘Administrator’ -p ‘P@ssw0rd123!’ –dc-ip 192.168.1.101

You will get the following output if using the Python version:

You will get the following output if using the Powershell version:

Cracking passwords

Once you have this wordlist, you should crack your NTDS using hashcat, –loopback, and the rule clem9669_large.rule.

./hashcat –hash-type 1000 –potfile-path ./client.potfile ./client.ntds ./wordlist.txt –rules ./clem9669_large.rule –loopback

Source: https://github.com/p0dalirius/

LDAPWordlistHarvester: generate a wordlist from the information present in LDAP

Search

Brilliantly

Content & Links