312-50 Question 93
Single answer▪ LDAP EnumerationDuring an internal authorized assessment, you identify a Windows domain controller at 10.10.20.15 that allows anonymous LDAP binds. Your objective is to enumerate directory information that could help map the Active Directory environment, such as user and group objects, without modifying any data. Which command is the most appropriate to perform this LDAP enumeration against the directory service?
- A
ldapsearch -x -H ldap://10.10.20.15 -b "DC=example,DC=com" "(objectClass=*)"
- B
nmap --script smb-enum-shares -p 445 10.10.20.15
- C
snmpwalk -v2c -c public 10.10.20.15 1.3.6.1.2.1.1
- D
dig AXFR example.com @10.10.20.15
Show answer and explanation
Correct answer: A
Explanation
The best choice is the ldapsearch command because LDAP enumeration requires speaking the LDAP protocol to the directory service and querying an appropriate base DN with a valid search filter. In Active Directory environments, anonymous bind may be restricted, but if it is enabled, tools such as ldapsearch can enumerate naming contexts, users, groups, computers, and organizational units without altering data. This aligns with standard LDAP query behavior defined in LDAPv3 (RFC 4511) and common operational usage of ldapsearch in directory environments. The other options query different services: SMB for shares, SNMP for management data, and DNS AXFR for zone data. Those may be useful in broader reconnaissance, but they are not the most appropriate method for LDAP enumeration itself.
- A. Correct.
Correct. This command uses ldapsearch with simple authentication mode (-x) and queries the LDAP service directly over ldap://. The base DN of DC=example,DC=com scopes the search to the domain naming context, and the filter (objectClass=*) requests directory objects for enumeration. This is a standard read-only LDAP enumeration approach when anonymous bind is permitted.
- B. Incorrect.
Incorrect. smb-enum-shares is an SMB enumeration script for listing file shares over TCP 445, not for querying LDAP directory objects. A candidate might choose this because SMB is commonly available on domain controllers, but it does not directly enumerate LDAP attributes such as users, groups, OUs, or directory metadata.
- C. Incorrect.
Incorrect. snmpwalk is used to query SNMP agents using a community string and OIDs. LDAP and SNMP are separate protocols with different purposes. This distractor is plausible because both can reveal infrastructure information, but SNMP does not enumerate Active Directory objects through LDAP.
- D. Incorrect.
Incorrect. A DNS zone transfer request using dig AXFR targets DNS replication data, not LDAP directory contents. While DNS can reveal hostnames if misconfigured, it will not provide LDAP objects such as users, groups, or directory structure. This reflects a common misconception that any directory-related service on a domain controller can substitute for LDAP enumeration.