← retour aux outils back to tools

# ldeep

Outil d'énumération LDAP approfondie pour Active Directory. Extrait utilisateurs, groupes, ordinateurs, GPO, trusts, ACL et plus encore via des requêtes LDAP. In-depth LDAP enumeration tool for Active Directory. Dumps users, groups, computers, GPOs, trusts, ACLs, and more via LDAP queries.

↗ https://github.com/franc-pentest/ldeep

## Overview

ldeep performs comprehensive LDAP enumeration against Active Directory. It dumps users, computers, groups, GPOs, trusts, password policies, LAPS passwords, Kerberoastable/ASREProastable accounts, and more. Results can be saved to JSON or CSV for offline analysis.

## Basic Usage

Enumerate with domain credentials

    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 all

    # Enumerate specific objects
    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 users
    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 computers
    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 groups

With NTLM hash (pass-the-hash)

    ldeep ldap -u user -H 'NTLM_HASH' -d domain.local -s ldap://DC01 all

With Kerberos ticket

    ldeep ldap -k -d domain.local -s ldap://DC01 all

## Enumeration Categories

User accounts

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users

Computer accounts

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 computers

    # Groups and memberships
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 groups
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 memberships -g "Domain Admins"

GPO enumeration

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 gpos

Domain trusts

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 trusts

Password policy

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 pso

## Privilege Escalation Targets

Kerberoastable accounts (have SPNs)

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 kerberoastable

ASREProastable accounts (no preauth required)

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 asreproastable

LAPS passwords (if you have read access)

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

Unconstrained delegation

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 unconstraineddelegation

Constrained delegation

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 constraineddelegation

## Output Options

Save all results to JSON directory

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 all -o /tmp/ldeep_output

JSON format

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --json

CSV format

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --csv

## Tips

- Run `all` to dump everything in one shot and analyze offline
- Compare against BloodHound data to find paths not shown in the graph
- LAPS reads require specific delegated permissions — try if you have high-value user access
- Kerberoastable accounts: collect their hashes with GetUserSPNs.py and crack offline

Help / Man page

    ldeep ldap [options] <command>

    -u USER         Username
    -p PASS         Password
    -H HASH         NTLM hash
    -d DOMAIN       Domain
    -s LDAP_URL     LDAP server URL (ldap:// or ldaps://)
    -k              Use Kerberos authentication
    -o DIR          Output directory

    Commands:
      all                     Dump everything
      users                   List users
      computers               List computers
      groups                  List groups
      memberships -g GROUP    List members of a group
      gpos                    List GPOs
      trusts                  Domain trusts
      kerberoastable          Kerberoastable accounts
      asreproastable          ASREProastable accounts
      laps                    Read LAPS passwords
      unconstraineddelegation Unconstrained delegation accounts
      constraineddelegation    Constrained delegation accounts
      pso                     Password policies

## Vue d’ensemble

ldeep effectue une énumération LDAP complète contre Active Directory. Il extrait les utilisateurs, ordinateurs, groupes, GPO, trusts, politiques de mot de passe, mots de passe LAPS, comptes kerberoastables/ASREProastables, et plus encore. Les résultats peuvent être sauvegardés en JSON ou CSV pour une analyse hors ligne.

## Utilisation de base

    # Énumérer avec des identifiants de domaine
    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 all

    # Énumérer des objets spécifiques
    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 users
    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 computers
    ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 groups

    # Avec un hash NTLM (pass-the-hash)
    ldeep ldap -u user -H 'NTLM_HASH' -d domain.local -s ldap://DC01 all

    # Avec un ticket Kerberos
    ldeep ldap -k -d domain.local -s ldap://DC01 all

## Catégories d’énumération

    # Comptes utilisateurs
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users

    # Comptes ordinateurs
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 computers

    # Groupes et appartenances
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 groups
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 memberships -g "Domain Admins"

    # Énumération des GPO
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 gpos

    # Trusts de domaine
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 trusts

    # Politique de mot de passe
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 pso

## Cibles d’escalade de privilèges

    # Comptes kerberoastables (ont des SPN)
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 kerberoastable

    # Comptes ASREProastables (pas de pré-authentification requise)
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 asreproastable

    # Mots de passe LAPS (si accès en lecture disponible)
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

    # Délégation sans contrainte
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 unconstraineddelegation

    # Délégation contrainte
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 constraineddelegation

## Options de sortie

    # Sauvegarder tous les résultats dans un dossier JSON
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 all -o /tmp/ldeep_output

    # Format JSON
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --json

    # Format CSV
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --csv

## Conseils

- Lancer `all` pour tout extraire en une fois et analyser hors ligne
- Comparer avec les données BloodHound pour trouver des chemins non affichés dans le graphe
- Les lectures LAPS nécessitent des permissions déléguées spécifiques : à tenter si vous avez un accès utilisateur à haute valeur
- Comptes kerberoastables : récupérer leurs hashs avec GetUserSPNs.py et les cracker hors ligne

Aide / Page de manuel

    ldeep ldap [options] <command>

    -u USER         Username
    -p PASS         Password
    -H HASH         NTLM hash
    -d DOMAIN       Domain
    -s LDAP_URL     LDAP server URL (ldap:// or ldaps://)
    -k              Use Kerberos authentication
    -o DIR          Output directory

    Commands:
      all                     Dump everything
      users                   List users
      computers               List computers
      groups                  List groups
      memberships -g GROUP    List members of a group
      gpos                    List GPOs
      trusts                  Domain trusts
      kerberoastable          Kerberoastable accounts
      asreproastable          ASREProastable accounts
      laps                    Read LAPS passwords
      unconstraineddelegation Unconstrained delegation accounts
      constraineddelegation    Constrained delegation accounts
      pso                     Password policies