- [Instructor] We've already looked at LDAP Admin
to provide a GUI interface to LDAP,
and there's another open source tool worth looking at
called JXplorer, the Java-based LDAP Explorer tool.
This doesn't come as standard in Kali,
so we need to install it using APT.
Sudo apt install jxplorer.
Okay, that's all we need to do.
So, now we can start up the JXplorer tool.
Jxplorer.
Let's take a first look at Active Directory's LDAP service,
using JXplorer.
At the main screen, we click on the connect icon,
and put in the host, 192.168.1.199.
And we'll change the level to user ID and password.
And the user DN is aadama31@cybex.com.
And the password is bluemarble22.
We now get the LDAP tree displayed in the pane on the left,
with its top level entry of cybex.com,
and its three subordinate entries
of Configuration, DomainDnsZones, and ForestDnsZones.
In Configuration, we can expand the schema entry,
and we get a warning that only 1000 entries are returned;
it's a large schema.
Opening the domain DNS zones isn't quite so daunting,
with just four entries.
If we expand Microsoft DNS, we see that cybex.com
is our DNS entry,
and we can expand that,
and we see the various networking entries for our domain.
Then the entry, DESKTOP-11RRJVH,
which is our one token work station
in the domain at the moment.
Active directory is a complex product,
and finding data in the tree is no simple matter.
Manually walking the tree is a long process.
So, let's use JXplorer's search capability.
We'll highlight cybex, and we'll enter cn=*,
and we'll click quick search;
and we get 243 entries.
We can see the standard active directory entries
together with the domain specific entries
for organizational units and users of Cybex.
If we want to clearer a view of the organization,
we can do the search again.
This time, changing cn to ou,
and clicking quick search;
and we get 11 entries.
And now we get the organizational tree
for the cybex.com domain.
We've got Finance, IT, Personnel, and Sales,
with their sub-organizational user accounts.
When we look at Admins,
we can see it's an organizationalUnit record.
In this view, to see the actual users,
we need to click on the IT Admin organizationalUnit,
and select search,
and in the text filter, enter cn=*, and search.
And we get the two IT admins.
Let's click on the entry, "Akhtar Katt",
and we see the detailed record in the right hand pane.
Note that we don't get the user password hash
as part of a normal remote query.
We can switch the display from HTML View
to Table Editor View using the top tab,
and that shows a much more complete view
of the active directory record.
Let's run a more involved query.
Firstly, let's set our search attributes.
From the search menu, let's select Return Attributes.
And then, in the dialogue box, set the name to UserRef
to refer to this output format.
And select the attributes, sAMAccountName,
userPrincipleName, and memberOf.
And we can save this.
Okay.
We'll then highlight the domain cybex
in the tree on the left, and right click, and search.
We'll set the information to retrieve as UserRef,
and we'll build a filter
by setting the field to adminCount Equal To 1.
And we can click search, and we get 18 entries.
When we click search, we get a list of all accounts
which have adminCount set to 1.
At the top, We see Administrator,
and if we scroll down,
we can see jdoe76, aadama31, and akatt42; from Cybex.
Note also, the various groups,
such as print and backup operators
also have their adminCount set to 1.
AdminCount doesn't necessarily mean an account
has administrative privileges,
but the behavior and processes associated
with these accounts is complex and worth investigation.