diff --git a/javascript/enumeration/ldap/ldap-get-ad-grp.yaml b/javascript/enumeration/ldap/ldap-get-ad-grp.yaml new file mode 100644 index 0000000000..e789ad3345 --- /dev/null +++ b/javascript/enumeration/ldap/ldap-get-ad-grp.yaml @@ -0,0 +1,42 @@ +id: ldap-get-ad-grp + +info: + name: LDAP Get Active Directory Group - Enumeration + author: pussycat0x + severity: info + description: | + Attempts to list the supported capabilities in a SMBv2 server for each enabled dialect. + reference: + - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/ldap.Client#getadgroups + metadata: + max-request: 1 + shodan-query: ldap + tags: js,network,ldap,enum + +javascript: + - code: | + const ldap = require('nuclei/ldap'); + const cfg = new ldap.Config(); + cfg.Upgrade = true; + const client = new ldap.Client(Host, Port, cfg); + const groups = client.GetADGroups(); + const bytes = require('nuclei/bytes'); + const buffer = new bytes.Buffer(); + for (const group of groups) { + buffer.WriteString("DistinguishedName: '" + group.DistinguishedName+ "' ,"); + buffer.WriteString("SAMAccountName: '" + group.SAMAccountName+ "' ,"); + buffer.WriteString("PWDLastSet: '" + group.PWDLastSet+ "' ,"); + buffer.WriteString("LastLogon: '" + group.LastLogon+ "' ,"); + buffer.WriteString("MemberOf: '" + group.MemberOf+ "' ,"); + buffer.WriteString("ServicePrincipalName: '" + group.ServicePrincipalName+ "' ,"); + } + Export(buffer.String()); + + args: + Host: "ldap://{{Host}}" + Port: 389 + + extractors: + - type: dsl + dsl: + - response \ No newline at end of file diff --git a/javascript/enumeration/ldap/ldap-get-ad-users.yaml b/javascript/enumeration/ldap/ldap-get-ad-users.yaml new file mode 100644 index 0000000000..5bf762ea72 --- /dev/null +++ b/javascript/enumeration/ldap/ldap-get-ad-users.yaml @@ -0,0 +1,41 @@ +id: ldap-get-ad-users +info: + name: LDAP Get Active Directory User - Enumeration + author: pussycat0x + severity: info + description: | + Retrieve users from Active Directory, where each user is represented by an ADObject. + reference: + - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/ldap.ADObject + metadata: + max-request: 1 + shodan-query: ldap + tags: js,network,ldap,enum + +javascript: + - code: | + const ldap = require('nuclei/ldap'); + const cfg = new ldap.Config(); + cfg.Upgrade = true; + const client = ldap.Client(Host, Port, cfg); + const users = client.GetADUsers(); + const bytes = require('nuclei/bytes'); + const buffer = new bytes.Buffer(); + for (const user of users) { + buffer.WriteString("DistinguishedName: '" + user.DistinguishedName+ "' ,"); + buffer.WriteString("SAMAccountName: '" + user.SAMAccountName+ "' ,"); + buffer.WriteString("PWDLastSet: '" + user.PWDLastSet+ "' ,"); + buffer.WriteString("LastLogon: '" + user.LastLogon+ "' ,"); + buffer.WriteString("MemberOf: '" + user.MemberOf+ "' ,"); + buffer.WriteString("ServicePrincipalName: '" + user.ServicePrincipalName+ "' ,"); + } + Export(buffer.String()); + + args: + Host: "ldap://{{Host}}" + Port: 389 + + extractors: + - type: dsl + dsl: + - response \ No newline at end of file diff --git a/javascript/enumeration/ldap/ldap-metadata.yaml b/javascript/enumeration/ldap/ldap-metadata.yaml new file mode 100644 index 0000000000..87666e50b8 --- /dev/null +++ b/javascript/enumeration/ldap/ldap-metadata.yaml @@ -0,0 +1,37 @@ +id: ldap-metadata + +info: + name: LDAP Metadata - Enumeration + author: pussycat0x + severity: info + description: | + LDAP metadata refers to the data that describes the structure, schema, and attributes of the LDAP directory + reference: + - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/ldap.Metadata + metadata: + max-request: 1 + shodan-query: ldap + tags: js,network,ldap + +javascript: + - code: | + const ldap = require('nuclei/ldap'); + const cfg = new ldap.Config(); + cfg.Upgrade = true; + const client = new ldap.Client(Host, Port, cfg); + const metadata = client.CollectMetadata(); + Export(metadata) + + args: + Host: "ldap://{{Host}}" + Port: 389 + + extractors: + - type: json + json: + - '"BaseDN: " + .BaseDN' + - '"DnsHostName: " + .DnsHostName ' + - '"DefaultNamingContext: "+ .DefaultNamingContext' + - '"DomainFunctionality: "+ .DomainFunctionality' + - '"ForestFunctionality: " + .ForestFunctionality' + - '"DomainControllerFunctionality: "+ .DomainControllerFunctionality' \ No newline at end of file