ldapnomnom v1.1 releases: Anonymously bruteforce Active Directory username

by do son · Published December 6, 2022 · Updated December 16, 2022

Anonymously bruteforce Active Directory usernames from Domain Controllers by abusing LDAP Ping requests (cLDAP)

Looks for enabled normal user accounts. No Windows audit logs were generated. High-speed ~ up to 10K/sec – go beyond 25K/sec with multiple servers!

Tries to autodetect DC from environment variables on domain joined machines or falls back to machine hostname FQDN DNS suffix
Reads usernames to test from stdin (default) or file
Outputs to stdout (default) or file
Parallelized, multiple connections to multiple servers (defaults to 8 servers, 8 connections per server)
Shows a progressbar if you’re using both input and output files
Evasive maneuvers: Use –throttle 20 for a 20ms delay between each request (slows everything down to a crawl)
Evasive maneuvers: Use –maxrequests 1000 to close the connection and reconnect after 1000 requests in each connection (try to avoid detection based on traffic volume)

Connect to up to 32 servers from contoso.local with 16 connections to each – FAAAAAAAST

ldapnomnom –input 10m_usernames.txt –output multiservers.txt –dnsdomain contoso.local –maxservers 32 –parallel 16

Connect to one named server with 4 connections

ldapnomnom –input 10m_usernames.txt –output results.txt –server 192.168.0.11 –parallel 4

Look for username lists to feed into this elsewhere – for instance, the 10M list from here

No Windows event logs are generated (tested on Windows 2016 / 2019)
Requires custom network-level monitoring (unencrypted LDAP analysis or traffic volume for LDAPS)