Authentication

LDAP Authentication

Testing if an account exists without kerberos protocol

nxc ldap <target> -u users.txt -p '' -k

Testing credentials

nxc ldap <target> -u <username> -p <password>
nxc ldap <target> -u <username> -H <hash>

Expected Results:

LDAP        <target> 5985   ROGER            [+] <domain>\<username>:<password>

{% hint style="warning" %}
Domain name resolution is expected
{% endhint %}

By default, the ldap protocol will get the domain name by making connection to the SMB share (of the dc), if you don't want that initial connection, just add the option --no-smb