# LDAPWordlistHarvester | A Tool To Generate A Wordlist From The Information Present In LDAP

**URL:** <https://onehack.st/t/ldapwordlistharvester-a-tool-to-generate-a-wordlist-from-the-information-present-in-ldap/283787>\
**Category:** Tools & Scripts\
**Tags:** tools, cracking, freebies, data-recovery, windows\
**Created:** [June 1, 2024, 7:21pm UTC](https://onehack.st/t/ldapwordlistharvester-a-tool-to-generate-a-wordlist-from-the-information-present-in-ldap/283787 "2024-06-01T19:21:15Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [June 1, 2024, 7:21pm UTC](https://onehack.st/t/ldapwordlistharvester-a-tool-to-generate-a-wordlist-from-the-information-present-in-ldap/283787/1 "2024-06-01T19:21:15Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/c/1/c13e2e6e261543d5e6355cf839408c84400ed3b5.png)

A tool to generate a wordlist from the information present in LDAP, in order to crack non-random passwords of domain accounts.  
[![GitHub release (latest by date)](https://camo.githubusercontent.com/d17e1f46c54fbe68d16848882a5f2f1b5308673d1f8a17c8015806ff00f83aad/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f703064616c69726975732f457874726163744269746c6f636b65724b657973)](https://camo.githubusercontent.com/d17e1f46c54fbe68d16848882a5f2f1b5308673d1f8a17c8015806ff00f83aad/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f703064616c69726975732f457874726163744269746c6f636b65724b657973) [![](https://camo.githubusercontent.com/0864961c9d38b7c748e4f786e584bdd74f381f45a4969377d74a171052f9248e/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f706f64616c69726975735f3f6c6162656c3d506f64616c6972697573267374796c653d736f6369616c)](https://twitter.com/intent/follow?screen_name=podalirius_) [![YouTube Channel Subscribers](https://camo.githubusercontent.com/dd30109c3333ee395a1c5fdcc5d34c57a73efa3d674ef07728fadd62cd6d5f2f/68747470733a2f2f696d672e736869656c64732e696f2f796f75747562652f6368616e6e656c2f73756273637269626572732f5543465f78354f3743536672383241664e56544b4f765f413f7374796c653d736f6369616c)](https://www.youtube.com/c/Podalirius_?sub_confirmation=1)

## Features

_The bigger the domain is, the better the wordlist will be._

- Creates a wordlist based on the following information found in the LDAP:
  - **User** : `name` and `sAMAccountName`
  - **Computer** : `name` and `sAMAccountName`
  - **Groups** : `name`
  - **Organizational Units** : `name`
  - **Active Directory Sites** : `name` and `descriptions`
  - **All LDAP objects** : `descriptions`

- Choose wordlist output file name with option `--outputfile`

* * *

## Demonstration

To generate a wordlist from the LDAP of the domain `domain.local` you can use this command:

```auto
./LDAPWordlistHarvester.py -d 'domain.local' -u 'Administrator' -p 'P@ssw0rd123!' --dc-ip 192.168.1.101

```

You will get the following output if using the [Python version](https://github.com/p0dalirius/LDAPWordlistHarvester/blob/main/LDAPWordlistHarvester.py):

[![](https://github.com/p0dalirius/LDAPWordlistHarvester/raw/main/.github/example_python.png)](https://github.com/p0dalirius/LDAPWordlistHarvester/blob/main/.github/example_python.png)

You will get the following output if using the [Powershell version](https://github.com/p0dalirius/LDAPWordlistHarvester/blob/main/LDAPWordlistHarvester.ps1):

[![](https://github.com/p0dalirius/LDAPWordlistHarvester/raw/main/.github/example_powershell.png)](https://github.com/p0dalirius/LDAPWordlistHarvester/blob/main/.github/example_powershell.png)

* * *

## Cracking passwords

Once you have this wordlist, you should crack your NTDS using hashcat, `--loopback` and the rule [clem9669\_large.rule](https://github.com/clem9669/hashcat-rule/blob/master/clem9669_large.rule).

```auto
./hashcat --hash-type 1000 --potfile-path ./client.potfile ./client.ntds ./wordlist.txt --rules ./clem9669_large.rule --loopback

```

* * *

## Usage

```auto
$ ./LDAPWordlistHarvester.py -h
LDAPWordlistHarvester.py v1.1 - by @podalirius_

usage: LDAPWordlistHarvester.py [-h] [-v] [-o OUTPUTFILE] --dc-ip ip address [-d DOMAIN] [-u USER] [--ldaps] [--no-pass | -p PASSWORD | -H [LMHASH:]NTHASH | --aes-key hex key] [-k]

options:
  -h, --help show this help message and exit
  -v, --verbose Verbose mode. (default: False)
  -o OUTPUTFILE, --outputfile OUTPUTFILE
                        Path to output file of wordlist.

Authentication & connection:
  --dc-ip ip address IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameter
  -d DOMAIN, --domain DOMAIN
                        (FQDN) domain to authenticate to
  -u USER, --user USER user to authenticate with
  --ldaps Use LDAPS instead of LDAP

Credentials:
  --no-pass Don't ask for password (useful for -k)
  -p PASSWORD, --password PASSWORD
                        Password to authenticate with
  -H [LMHASH:]NTHASH, --hashes [LMHASH:]NTHASH
                        NT/LM hashes, format is LMhash:NThash
  --aes-key hex key AES key to use for Kerberos Authentication (128 or 256 bits)
  -k, --kerberos Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line

```

## GitHub:

[https://github.com/p0dalirius/LDAPWordlistHarvester](https://github.com/p0dalirius/LDAPWordlistHarvester)