Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LDAP Auth Testing - Feature Request? #274

Open
mubix opened this issue Mar 30, 2024 · 0 comments
Open

LDAP Auth Testing - Feature Request? #274

mubix opened this issue Mar 30, 2024 · 0 comments

Comments

@mubix
Copy link

mubix commented Mar 30, 2024

Not sure exactly what is going wrong but here are the steps I'm using to test:

  1. Added a DNS entry to my "testing.local" domain called "testingserver.testing.local" (I know inventive...)
  2. Run Responder - default configuration w/ verbose
  3. Open up LDP and connect
image
  1. Bind as the current user:
image

Result:

ld = ldap_open("testingserver.testing.local", 389);
Established connection to testingserver.testing.local.
Retrieving base DSA information...
Getting 0 entries:
-----------
0 = ldap_set_option(ld, LDAP_OPT_ENCRYPT, 1)
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, NEGOTIATE (1158)); // v.3
	{NtAuthIdentity: User='NULL'; Pwd=<unavailable>; domain = 'NULL'}
Error <81>: ldap_bind_s() failed: Server Down.
Server error: <empty>
-----------

Nothing shows up on Responder at all to even say a connection happened even with verbosity.

UPDATE 1:

I tried again, turning the "encrypt traffic after bind" off and I got a hash.

Oddly enough "NTLM" didn't work in the Advanced setting:
image

UPDATE 2:

I attempted LDAP connection using certutil: certutil -store "ldap://testingserver.testing.local/DC=testing,DC=local"
And that came straight back without any output from Responder.

UPDATE 3:

Super odd behavior. If I leave "Encrypt after bind" on and use the "Negotiate" advanced method with a random user, I get a hash, if I go back and tell it to use "Bind as currently logged in user" AFTER that, I get a hash. So I don't think "Encrypt after bind" was the problem.

Update 4:

Simply attempting to bind twice seems to be what does it enough to get the hash.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant