dirkjanm / ldapdomaindump

Active Directory information dumper via LDAP
MIT License
1.19k stars 190 forks source link

Adding Kerberos Support #47

Open Parrishjm opened 2 years ago

Parrishjm commented 2 years ago

A fairly simple method of adding in Kerberos support. Very little code is added to achieve this and most of it is boiler plate to tell which type of connection we should be making. Additionally if Kerberos is selected a startTLS() call is made. Lastly gssapi was added as a requirement.

The usage of this new feature would work as follows:

  1. if you dont have Kerberos support installed, install it and configure it for the environment you plan to run this.
  2. obtain a ccache file using kinit or obtain one through other methods.
  3. preform ldapdomaindump with the -k flag, remembering to provide a FQDN instead of an IP address.
  4. Get ldapdomaindump using Kerberos.

This has been tested on kali machines. Tests were preformed using all previous methods of commands I could think of to ensure to logic was removed as well as in multiple domain setups to include ones with channel binding and signing requirements. No issues were found.