LDAP Ports

LDAP and related ports name AD query surfaces — document lab ports on $LAB_AD; defenders restrict and monitor binds.

LDAP Ports• Audio Walkthrough

00:00/03:22

Visual · t25_ldap_ports

LDAP port literacy. $LAB_AD only. Original Cyberlium.

Enum starts with knowing which ports answer — literacy before any collector runs.

LDAP 389/tcp (636/tcp LDAPS), Global Catalog 3268/3269, Kerberos 88, SMB 445, RPC dynamic/high — common AD service map. Signed/sealed LDAP and channel binding reduce relay and tampering risk. Defenders restrict anonymous binds and monitor query volume. Cyberlium documents port map for YOUR $LAB_AD DC — not port-scanning stranger DCs. Next: BloodHound Named.

1. Core AD ports (named)

389/636: LDAP/LDAPS directory queries. 3268/3269: Global Catalog. 88: Kerberos. 445: SMB (SYSVOL, shares). 135 + dynamic RPC: remote admin interfaces — restrict in production.

On $LAB_AD, table DC IP with these ports and note whether LDAPS is required in lab — observation from YOUR scope only.

Command guide

Try these commands — Core AD ports (named)

═══ WINDOWS / POWERSHELL (Lab Host) ═══

Discover Domain Controllers in current forest

Command — copy this

nltest /dclist:$env:USERDOMAIN

Enumerate domain admins and high-privilege groups

Command — copy this

net group "Domain Admins" /domain
net group "Enterprise Admins" /domain

Query AD objects via LDAP filter

Command — copy this

Get-ADObject -LDAPFilter "(adminCount=1)" -Properties SamAccountName, distinguishedName

═══ LINUX / BASH (Lab Network) ═══ Query AD LDAP anonymously or with lab credentials

Command — copy this

ldapsearch -x -H ldap://${LAB_AD_HOST:-127.0.0.1} -b "dc=lab,dc=local" "(objectClass=organizationalPerson)" sAMAccountName 2>/dev/null | head -15

Primary tools to practice this lesson: nmap, curl. Reference sites: LDAP ports (https://learn.microsoft.com/en-us/windows/win32/ad/active-directory-domain-services); Microsoft AD ports (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-ldap-over-ssl); Nmap LDAP (https://nmap.org/nsedoc/scripts/ldap-rootdse.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Signed LDAP and channel binding (defender)

LDAP signing and sealing integrity-protects directory traffic. Channel binding mitigates some relay classes. GPO and domain controller settings enforce requirements — defenders audit non-compliant clients.

Literacy: unsigned LDAP from untrusted networks is a finding — fix with signing requirements, not unauthorized scanning.

3. Literacy ≠ stranger port scan

Forbidden: nmap LDAP against corporate DC ranges without authorization. Allowed: port table for $LAB_AD DC with defender hardening note per port.

Ship: LDAP port card — five ports, purpose, one hardening sentence. Next: BloodHound Named.

4. What you ship: AD port map for $LAB_AD

Five-port table with purposes and hardening notes. $LAB_AD DC IP. NO stranger scans. chmod 600.

5. What you record before the next lesson

Date. Port map. $LAB_AD named. File t25-m04-l01-ldap-ports.txt chmod 600.

6. Wrong vs right: stranger-domain attacks vs lab AD literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Port-scan campus AD ranges. Disable LDAP signing globally to 'ease enum.'
Right: Write port map for YOUR $LAB_AD DC with hardening notes. Next: BloodHound Named.

Hands-on Exercise