retour aux outils back to tools Ducklings

ldeep

Outil d'énumération LDAP approfondie pour Active Directory. Extrait utilisateurs, groupes, ordinateurs, GPO, trusts, ACL et plus encore via des requêtes LDAP. In-depth LDAP enumeration tool for Active Directory. Dumps users, groups, computers, GPOs, trusts, ACLs, and more via LDAP queries.

↗ https://github.com/franc-pentest/ldeep

Overview

ldeep performs comprehensive LDAP enumeration against Active Directory. It dumps users, computers, groups, GPOs, trusts, password policies, LAPS passwords, Kerberoastable/ASREProastable accounts, and more. Results can be saved to JSON or CSV for offline analysis.

Basic Usage

Enumerate with domain credentials

ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 all

# Enumerate specific objects
ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 users
ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 computers
ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 groups

With NTLM hash (pass-the-hash)

ldeep ldap -u user -H 'NTLM_HASH' -d domain.local -s ldap://DC01 all

With Kerberos ticket

ldeep ldap -k -d domain.local -s ldap://DC01 all

Enumeration Categories

User accounts

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users

Computer accounts

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 computers

# Groups and memberships
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 groups
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 memberships -g "Domain Admins"

GPO enumeration

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 gpos

Domain trusts

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 trusts

Password policy

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 pso

Privilege Escalation Targets

Kerberoastable accounts (have SPNs)

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 kerberoastable

ASREProastable accounts (no preauth required)

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 asreproastable

LAPS passwords (if you have read access)

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

Unconstrained delegation

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 unconstraineddelegation

Constrained delegation

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 constraineddelegation

Output Options

Save all results to JSON directory

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 all -o /tmp/ldeep_output

JSON format

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --json

CSV format

ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --csv

Tips

Run all to dump everything in one shot and analyze offline
Compare against BloodHound data to find paths not shown in the graph
LAPS reads require specific delegated permissions — try if you have high-value user access
Kerberoastable accounts: collect their hashes with GetUserSPNs.py and crack offline

Help / Man page

ldeep ldap [options] <command>

-u USER         Username
-p PASS         Password
-H HASH         NTLM hash
-d DOMAIN       Domain
-s LDAP_URL     LDAP server URL (ldap:// or ldaps://)
-k              Use Kerberos authentication
-o DIR          Output directory

Commands:
  all                     Dump everything
  users                   List users
  computers               List computers
  groups                  List groups
  memberships -g GROUP    List members of a group
  gpos                    List GPOs
  trusts                  Domain trusts
  kerberoastable          Kerberoastable accounts
  asreproastable          ASREProastable accounts
  laps                    Read LAPS passwords
  unconstraineddelegation Unconstrained delegation accounts
  constraineddelegation    Constrained delegation accounts
  pso                     Password policies

Vue d’ensemble

ldeep effectue une énumération LDAP complète contre Active Directory. Il extrait les utilisateurs, ordinateurs, groupes, GPO, trusts, politiques de mot de passe, mots de passe LAPS, comptes kerberoastables/ASREProastables, et plus encore. Les résultats peuvent être sauvegardés en JSON ou CSV pour une analyse hors ligne.

Utilisation de base

# Énumérer avec des identifiants de domaine
ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 all

# Énumérer des objets spécifiques
ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 users
ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 computers
ldeep ldap -u user -p 'P@ssw0rd' -d domain.local -s ldap://DC01 groups

# Avec un hash NTLM (pass-the-hash)
ldeep ldap -u user -H 'NTLM_HASH' -d domain.local -s ldap://DC01 all

# Avec un ticket Kerberos
ldeep ldap -k -d domain.local -s ldap://DC01 all

Catégories d’énumération

# Comptes utilisateurs
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users

# Comptes ordinateurs
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 computers

# Groupes et appartenances
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 groups
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 memberships -g "Domain Admins"

# Énumération des GPO
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 gpos

# Trusts de domaine
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 trusts

# Politique de mot de passe
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 pso

Cibles d’escalade de privilèges

# Comptes kerberoastables (ont des SPN)
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 kerberoastable

# Comptes ASREProastables (pas de pré-authentification requise)
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 asreproastable

# Mots de passe LAPS (si accès en lecture disponible)
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 laps

# Délégation sans contrainte
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 unconstraineddelegation

# Délégation contrainte
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 constraineddelegation

Options de sortie

# Sauvegarder tous les résultats dans un dossier JSON
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 all -o /tmp/ldeep_output

# Format JSON
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --json

# Format CSV
ldeep ldap -u user -p pass -d domain.local -s ldap://DC01 users --csv

Conseils

Lancer all pour tout extraire en une fois et analyser hors ligne
Comparer avec les données BloodHound pour trouver des chemins non affichés dans le graphe
Les lectures LAPS nécessitent des permissions déléguées spécifiques : à tenter si vous avez un accès utilisateur à haute valeur
Comptes kerberoastables : récupérer leurs hashs avec GetUserSPNs.py et les cracker hors ligne

Aide / Page de manuel

ldeep ldap [options] <command>

-u USER         Username
-p PASS         Password
-H HASH         NTLM hash
-d DOMAIN       Domain
-s LDAP_URL     LDAP server URL (ldap:// or ldaps://)
-k              Use Kerberos authentication
-o DIR          Output directory

Commands:
  all                     Dump everything
  users                   List users
  computers               List computers
  groups                  List groups
  memberships -g GROUP    List members of a group
  gpos                    List GPOs
  trusts                  Domain trusts
  kerberoastable          Kerberoastable accounts
  asreproastable          ASREProastable accounts
  laps                    Read LAPS passwords
  unconstraineddelegation Unconstrained delegation accounts
  constraineddelegation    Constrained delegation accounts
  pso                     Password policies