LDAPDomainDump

LDAPDomainDump is a tool to dump domain information (users, computers, groups, policies, and trusts) via LDAP. It supports outputting data in HTML, JSON, and greppable formats.

Basic Usage

To connect to a host, you must provide the hostname or an LDAP connection string. You can specify credentials for authentication.

python ldapdomaindump.py <HOSTNAME> -u 'DOMAIN\username' -p 'PASSWORD'

Authentication

• Host: Use HOSTNAME or an ldap://host:port / ldaps://host:port connection string.
• User: Must include the domain (e.g., DOMAIN\username).
• Password: Can be a plain password or an LM:NTLM hash. If not provided via -p, the tool will prompt for it.
• Auth Type: Use -at or --authtype to choose between NTLM (default) or SIMPLE.
• Anonymous: If no user is provided, it attempts an anonymous connection (though this often fails in production environments).

The domainDumpConfig class holds the default configuration settings for the LDAP domain dump process. You can instantiate this class to customize output file names, formats, and network behaviors.

Key configuration attributes include:

• basepath: The directory where output files are saved (default: .).
• groupsfile, usersfile, computersfile, policyfile, trustsfile: Basenames for individual entity reports.
• users_by_group, computers_by_os: Basenames for combined/sorted reports.
• outputhtml, outputjson, outputgrep: Boolean flags to enable/disable specific output formats.
• groupedjson: Boolean flag to enable grouped JSON output for computers by OS.
• grepsplitchar: The delimiter used for greppable output (default: \t).
• lookuphostnames: Boolean; if true, attempts to resolve computer DNS names to IP addresses.
• dnsserver: The address of the DNS server to use for lookups.
• minimal: Boolean; if true, only queries a minimal set of attributes to reduce network/memory usage.

class domainDumpConfig():
    def __init__(self):
        #Base path
        self.basepath = '.'

    #Output files basenames
        self.groupsfile = 'domain_groups' #Groups
        self.usersfile = 'domain_users' #User accounts
        self.computersfile = 'domain_computers' #Computer accounts
        self.policyfile = 'domain_policy' #General domain attributes
        self.trustsfile = 'domain_trusts' #Domain trusts attributes

    #Combined files basenames
        self.users_by_group = 'domain_users_by_group' #Users sorted by group
        self.computers_by_os = 'domain_computers_by_os' #Computers sorted by OS

    #Output formats
        self.outputhtml = True
        self.outputjson = True
        self.outputgrep = True

    #Output json for groups
        self.groupedjson = False

    #Default field delimiter for greppable format is a tab
        self.grepsplitchar = '\t'

    #Other settings
        self.lookuphostnames = False #Look up hostnames of computers to get their IP address
        self.dnsserver = '' #Addres of the DNS server to use, if not specified default DNS will be used
        self.minimal = False #Only query minimal list of attributes

The ldapdomaindump CLI allows you to dump Active Directory information via LDAP.

Required Argument:

• HOSTNAME: Hostname/IP or an ldap://host:port connection string (use ldaps:// for SSL).

Authentication Options:

• -u USERNAME, --user USERNAME: Domain\username. Leave empty for anonymous authentication.
• -p PASSWORD, --password PASSWORD: Password or LM:NTLM hash. Will prompt if omitted.
• -at {NTLM,SIMPLE}, --authtype {NTLM,SIMPLE}: Authentication type (default is NTLM).

Output Options:

• -o DIRECTORY, --outdir DIRECTORY: Directory to save the dump (default: current).
• --no-html, --no-json, --no-grep: Disable specific output formats.
• --grouped-json: Write JSON files for grouped files (default: disabled).
• -d DELIMITER, --delimiter DELIMITER: Field delimiter for greppable output (default: tab).

Miscellaneous Options:

• -r, --resolve: Resolve computer hostnames to IPv4 addresses (may cause high traffic).
• -n DNS_SERVER, --dns-server DNS_SERVER: Use a custom DNS resolver (e.g., a Domain Controller IP).
• -m, --minimal: Only query a minimal set of attributes to limit memory usage.

usage: ldapdomaindump.py [-h] [-u USERNAME] [-p PASSWORD] [-at {NTLM,SIMPLE}]
                         [-o DIRECTORY] [--no-html] [--no-json] [--no-grep]
                         [--grouped-json] [-d DELIMITER] [-r] [-n DNS_SERVER]
                         [-m]
                         HOSTNAME

The reportWriter class is responsible for transforming the raw LDAP entries collected by domainDumper into various output formats (HTML, JSON, and Greppable text).

Key capabilities:

• HTML Generation: Uses generateHtmlTable and generateGroupedHtmlTables to create formatted tables. It includes logic to escape HTML special characters and format complex attributes like group DNs as clickable links.
• JSON Generation: Uses generateJsonList, generateJsonGroup, and generateJsonGroupedList to produce structured data. The grouped JSON format is particularly useful for the computers_by_os report.
• Greppable Output: Uses generateGrepList to create tab-separated or custom-delimited text files suitable for command-line tools like grep, awk, or cut.
• Attribute Formatting: The formatAttribute method handles the translation of raw LDAP values into human-readable strings, such as converting bitwise flags (UAC, Password Policy, Trust flags), SIDs, and time durations (converting nanoseconds to days or minutes).