pkg ldap

pkg/ldap - LDAP/LDAPS Client

LDAP client with support for password bind, NTLM hash bind, and Kerberos GSSAPI bind. Handles LDAP, LDAPS (implicit TLS), and STARTTLS.

Constructor

func NewClient(target session.Target, creds *session.Credentials) *Client

Connection

func (c *Client) Connect(useTLS bool) error
func (c *Client) Close()

useTLS	Port	Behavior
false	389 (default)	Plain LDAP
true	636	Implicit TLS (LDAPS)
true	389	STARTTLS upgrade

Authentication

Method	Description
Login()	Auto-detect: Kerberos -> NTLM hash -> password
LoginWithKerberos()	Kerberos GSSAPI SASL bind
LoginWithHash()	NTLM hash bind
LoginWithUser(username string)	Simple or NTLM bind with specific username

Login() checks credentials in priority order:

1. creds.UseKerberos -> Kerberos GSSAPI
2. creds.Hash != "" -> NTLM bind
3. Default -> simple bind with password

Search Operations

func (c *Client) Search(baseDN, filter string, attributes []string) (*goldap.SearchResult, error)
func (c *Client) SearchBase(baseDN, filter string, attributes []string) (*goldap.SearchResult, error)
func (c *Client) SearchWithPaging(baseDN, filter string, attributes []string, pageSize uint32) (*goldap.SearchResult, error)
func (c *Client) SearchWithControls(baseDN, filter string, attributes []string, controls []goldap.Control) (*goldap.SearchResult, error)

Directory Operations

Method	Signature	Description
GetDefaultNamingContext	() (string, error)	Get root DN from RootDSE
GetSchemaNamingContext	() (string, error)	Get schema DN from RootDSE

Additional Methods

File	Methods	Description
operations.go	Modify, Add, Delete	Standard LDAP write operations
delegation.go	FindDelegation	Delegation enumeration
spnusers.go	GetSPNUsers	SPN user enumeration for Kerberoasting
npusers.go	GetNPUsers	AS-REP roast target enumeration

Example: Enumerate Domain Users

package main

import (
    "fmt"
    "gopacket/pkg/ldap"
    "gopacket/pkg/session"
)

func main() {
    target := session.Target{Host: "dc01.corp.local"}
    creds := &session.Credentials{
        Domain:   "CORP",
        Username: "user",
        Password: "Password1",
    }

    client := ldap.NewClient(target, creds)
    defer client.Close()

    client.Connect(false)
    client.Login()

    baseDN, _ := client.GetDefaultNamingContext()

    result, err := client.SearchWithPaging(
        baseDN,
        "(&(objectCategory=person)(objectClass=user))",
        []string{"sAMAccountName", "distinguishedName", "userAccountControl"},
        1000,
    )
    if err != nil {
        fmt.Printf("[-] %v\n", err)
        return
    }

    for _, entry := range result.Entries {
        fmt.Printf("[+] %s\n", entry.GetAttributeValue("sAMAccountName"))
    }
}