Merge branch 'main' into Ldap-search

javascript/misconfiguration/ldap/ldap-anonymous-access.yaml

@@ -0,0 +1,32 @@
+id: ldap-anonumous-access
+
+info:
+  name: LDAP Anonymous Access - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    Detect Anonymous access on LDAP Server
+  reference:
+    - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/ldap.Client#getadgroups
+  metadata:
+    max-request: 1
+    shodan-query: ldap
+  tags: js,network,ldap,enum
+
+javascript:
+  - code: |
+      const ldap = require('nuclei/ldap');
+      const cfg = new ldap.Config();
+      cfg.Upgrade = true;
+      const client = ldap.Client(Host, Port, cfg);
+      const result = client.Authenticate('', '');
+      result;
+
+    args:
+      Host: "ldap://{{Host}}"
+      Port: 389
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "success == true"

javascript/misconfiguration/ldap/ldap-default-creds.yaml

@@ -0,0 +1,45 @@
+id: ldap-default-creds
+
+info:
+  name: LDAP Default Credential - Bruteforce
+  author: pussycat0x
+  severity: info
+  description: |
+    Attempts to guess username/password combinations over LDAP.
+  metadata:
+    shodan-query: ldap
+  tags: js,network,ldap,enum
+
+javascript:
+  - code: |
+      const ldap = require('nuclei/ldap');
+      const cfg = new ldap.Config();
+      cfg.Upgrade = true;
+      const client = ldap.Client(Host, Port, cfg);
+      const response = client.Authenticate(User, Pass);
+      response;
+
+    args:
+      Host: "ldap://{{Host}}"
+      Port: 389
+      User: "{{usernames}}"
+      Pass: "{{passwords}}"
+
+    attack: clusterbomb
+    payloads:
+      usernames:
+        - 'admin'
+        - 'administrator'
+        - 'guest'
+      passwords:
+        - 'admin'
+        - 'password'
+        - 'guest'
+
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'response != "[]"'
+          - 'success == true'
+        condition: and

javascript/misconfiguration/ldap/ldap-get-ad-grp.yaml

@@ -0,0 +1,42 @@
+id: ldap-get-ad-grp
+
+info:
+  name: LDAP Get Active Directory Group - Enumeration
+  author: pussycat0x
+  severity: info
+  description: |
+    Attempts to list the supported capabilities in a SMBv2 server for each enabled dialect.
+  reference:
+    - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/ldap.Client#getadgroups
+  metadata:
+    max-request: 1
+    shodan-query: ldap
+  tags: js,network,ldap,enum
+
+javascript:
+  - code: |
+      const ldap = require('nuclei/ldap');
+      const cfg = new ldap.Config();
+      cfg.Upgrade = true;
+      const client = new ldap.Client(Host, Port, cfg);
+      const groups = client.GetADGroups();
+      const bytes = require('nuclei/bytes');
+      const buffer = new bytes.Buffer();
+      for (const group of groups) {
+        buffer.WriteString("DistinguishedName: '" + group.DistinguishedName+ "' ,");
+        buffer.WriteString("SAMAccountName: '" + group.SAMAccountName+ "' ,");
+        buffer.WriteString("PWDLastSet: '" + group.PWDLastSet+ "' ,");
+        buffer.WriteString("LastLogon: '" + group.LastLogon+ "' ,");
+        buffer.WriteString("MemberOf: '" + group.MemberOf+ "' ,");
+        buffer.WriteString("ServicePrincipalName: '" + group.ServicePrincipalName+ "' ,");
+      }
+      Export(buffer.String());
+
+    args:
+      Host: "ldap://{{Host}}"
+      Port: 389
+      
+    extractors:
+      - type: dsl
+        dsl:
+          - response

javascript/misconfiguration/ldap/ldap-get-ad-users.yaml

@@ -0,0 +1,46 @@
+id: ldap-get-ad-users
+info:
+  name: LDAP Get Active Directory User - Enumeration
+  author: pussycat0x
+  severity: info
+  description: |
+    Retrieve users from Active Directory, where each user is represented by an ADObject.
+  reference:
+   - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/ldap.ADObject
+  metadata:
+    max-request: 1
+    shodan-query: ldap
+  tags: js,network,ldap,enum
+
+javascript:
+  - code: |
+      const ldap = require('nuclei/ldap');
+      const cfg = new ldap.Config();
+      cfg.Upgrade = true;
+      const client = ldap.Client(Host, Port, cfg);
+      const users = client.GetADUsers();
+      const bytes = require('nuclei/bytes');
+      const buffer = new bytes.Buffer();
+      for (const user of users) {
+        buffer.WriteString("DistinguishedName: '" + user.DistinguishedName+ "' ,");
+        buffer.WriteString("SAMAccountName: '" + user.SAMAccountName+ "' ,");
+        buffer.WriteString("PWDLastSet: '" + user.PWDLastSet+ "' ,");
+        buffer.WriteString("LastLogon: '" + user.LastLogon+ "' ,");
+        buffer.WriteString("MemberOf: '" + user.MemberOf+ "' ,");
+        buffer.WriteString("ServicePrincipalName: '" + user.ServicePrincipalName+ "' ,");
+      }
+      Export(buffer.String());
+
+    args:
+      Host: "ldap://{{Host}}"
+      Port: 389
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "success == true"  
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response

javascript/misconfiguration/ldap/ldap-user-enum.yaml

@@ -0,0 +1,44 @@
+id: ldap-user-enum
+
+info:
+  name: LDAP UserNames - Enumeration
+  author: pussycat0x
+  severity: info
+  description: |
+    Ldap Usrname Enumeration.
+  reference:
+    - https://cxyy4rle.blogspot.com/2019/09/testing-ldap-servers-with-examples.html
+  metadata:
+    max-request: 1
+    shodan-query: ldap
+  tags: js,network,ldap,anonymous
+
+javascript:
+  - code: |
+      const ldap = require('nuclei/ldap');
+      const cfg = new ldap.Config();
+      cfg.Upgrade = true;
+      const client = new ldap.Client(Host, Ldap, Port, cfg);
+      const dcs = client.Search('cn=admin','dc=acme','dc=com');
+      log(to_json(dcs));
+
+    args:
+      Host: "ldap://{{Host}}"
+      Ldap: "{{Host}}"
+      Port: 389
+      User: "{{usernames}}"
+      Pass: "{{passwords}}"
+
+    attack: clusterbomb
+    payloads:
+      usernames:
+        - 'root'
+      passwords:
+        - 'toor'
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'response != "[]"'
+          - 'success == true'
+        condition: and