312-50 Question 92
Single answer▪ LDAP EnumerationDuring an internal authorized assessment, you discover that a Windows domain controller is listening on TCP 389 and allows anonymous LDAP binds. The client wants to understand whether sensitive directory information can be exposed without valid credentials. Which action would be the most appropriate next step to verify LDAP enumeration risk while minimizing unnecessary noise and avoiding changes to the directory?
- A
Perform an anonymous LDAP search against the naming context to retrieve objects such as users, groups, and descriptions using a read-only query
- B
Use an unauthenticated SMB null session to dump the Active Directory database files directly from the domain controller
- C
Send repeated LDAP modify requests to test whether anonymous users can alter group membership and create accounts
- D
Run a password spraying attack against LDAP to identify valid usernames before attempting any directory queries
Show answer and explanation
Correct answer: A
Explanation
The best answer is to perform a limited, read-only anonymous LDAP search. In LDAP enumeration, a common and practical first step is querying RootDSE to identify values such as the defaultNamingContext, then searching that base for exposed objects and attributes. This approach aligns with the principle of least impact during authorized security testing: validate the exposure directly, avoid modifying directory data, and keep activity focused on the identified weakness. Microsoft Active Directory uses LDAP for directory queries, and when anonymous bind or overly permissive ACLs are allowed, attackers may enumerate users, groups, email addresses, and other metadata useful for follow-on attacks. Industry best practice is to restrict anonymous LDAP access, review ACLs on directory objects and attributes, and monitor LDAP query activity where appropriate.
- A. Correct.
Correct. If anonymous bind is permitted, the safest and most relevant validation step is to issue a read-only LDAP search against the directory naming context and review what objects and attributes are exposed. This directly tests LDAP enumeration risk, such as disclosure of usernames, group membership, organizational units, email addresses, and descriptive fields, without modifying data. In real environments, tools like ldapsearch or similar LDAP clients can query the RootDSE first to identify the base DN, then perform limited searches.
- B. Incorrect.
Incorrect. SMB null sessions and LDAP anonymous binds are different mechanisms. Even if anonymous LDAP access is enabled, that does not imply the ability to access NTDS.dit or dump Active Directory database files over SMB. This option confuses directory enumeration with file-system or administrative access and would not be an appropriate or realistic next step for verifying LDAP enumeration exposure.
- C. Incorrect.
Incorrect. LDAP modify operations are not necessary to verify enumeration risk and would be intrusive. The scenario asks for validation of information disclosure while minimizing noise and avoiding changes. Attempting anonymous modifications tests authorization for write access, which is a different and much more severe issue. It also risks changing production data, which is inappropriate unless explicitly authorized and carefully controlled.
- D. Incorrect.
Incorrect. Password spraying is an authentication attack used to discover valid credentials or weak passwords. It is unnecessary here because the host already permits anonymous LDAP binds. The goal is to assess what can be enumerated without credentials, so starting with password spraying would increase risk and noise while failing to answer the immediate question efficiently.