312-50 Question 91
Single answer▪ LDAP EnumerationDuring an internal authorized assessment, you discover a Windows domain controller at 10.10.20.15 with TCP 389 open. The client wants to know whether anonymous LDAP enumeration is possible and, if so, to identify naming contexts and basic directory information without using valid domain credentials. Which command is the best initial step to verify this safely and gather useful LDAP data?
- A
ldapsearch -x -H ldap://10.10.20.15 -s base -b "" namingContexts defaultNamingContext rootDomainNamingContext
- B
nmap --script smb-enum-users -p 445 10.10.20.15
- C
rpcclient -U "" 10.10.20.15 -c enumdomusers
- D
snmpwalk -v2c -c public 10.10.20.15 1.3.6.1.2.1.1
Show answer and explanation
Correct answer: A
Explanation
The best initial action is to query the LDAP Root DSE anonymously. In LDAP, the Root DSE is a special entry that clients can query to learn server capabilities and directory naming contexts without first knowing the domain DN. On Active Directory, attributes such as namingContexts and defaultNamingContext help identify the base DN for later searches. Using ldapsearch with an anonymous simple bind and a base-scope query is a safe, low-impact way to validate whether anonymous LDAP enumeration is possible. This aligns with standard LDAP behavior documented in LDAP specifications such as RFC 4512 and RFC 4511, and with Microsoft Active Directory practices for Root DSE discovery. The other options use different protocols, SMB/RPC or SNMP, and do not directly answer the client's question about anonymous LDAP enumeration.
- A. Correct.
Correct. This uses an anonymous simple bind (-x) against LDAP on port 389 and queries the Root DSE with a base-scope search (-s base -b ""). Root DSE is commonly queried to retrieve metadata such as namingContexts, defaultNamingContext, and rootDomainNamingContext. This is the appropriate first step to determine whether anonymous LDAP queries are allowed and to discover the directory structure before attempting broader enumeration.
- B. Incorrect.
Incorrect. This NSE script targets SMB user enumeration over port 445, not LDAP. While user enumeration may be useful in some environments, it does not test whether anonymous LDAP access is permitted or retrieve LDAP naming contexts from the directory service.
- C. Incorrect.
Incorrect. rpcclient can enumerate certain Windows information over RPC/SMB when null sessions or other access are allowed, but it is not an LDAP query and does not directly test anonymous LDAP enumeration. A candidate might choose this because null-session enumeration is a common Windows assessment technique, but it is the wrong protocol for the stated objective.
- D. Incorrect.
Incorrect. SNMP enumeration is unrelated to LDAP directory queries. Although SNMP can expose valuable host or network information if misconfigured, it does not help determine whether anonymous LDAP binds are allowed or reveal LDAP naming contexts.