Network

Really enjoying this one :’-(

Alright I’ve got thus far now I’m stumped, can ANYONE shed some light on this, I’m just bashing in anything right now...

root@kali: # ldapsearch -h challenge01.root-me.org -x -p 54013 -s base -b "" +
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: +
#

#
dn:
structuralObjectClass: OpenLDAProotDSE
configContext: cn=config
namingContexts: dc=challenge01,dc=root-me,dc=org
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4
supportedControl: 1.3.6.1.4.1.4203.1.10.1
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.826.0.1.3344810.2.3
supportedControl: 1.3.6.1.1.13.2
supportedControl: 1.3.6.1.1.13.1
supportedControl: 1.3.6.1.1.12
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedExtension: 1.3.6.1.1.8
supportedFeatures: 1.3.6.1.1.14
supportedFeatures: 1.3.6.1.4.1.4203.1.5.1
supportedFeatures: 1.3.6.1.4.1.4203.1.5.2
supportedFeatures: 1.3.6.1.4.1.4203.1.5.3
supportedFeatures: 1.3.6.1.4.1.4203.1.5.4
supportedFeatures: 1.3.6.1.4.1.4203.1.5.5
supportedLDAPVersion: 3
supportedSASLMechanisms: DIGEST-
supportedSASLMechanisms: NTLM
supportedSASLMechanisms: CRAM-MD5
entryDN:
subschemaSubentry: cn=Subschema

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Thanks,

You are very close. Think about the -b and what you are wanting to bind to???
If you are not sure do some research on LDAP and the different binding attributes and distinguished names.
for example what does cn, dn, ou, dc .... etc mean?

Hi team!

It seems port is closed, please check.
nmap challenge01.root.me.org -p54013

Starting Nmap 7.40 ( https://nmap.org ) at 2017-06-22 16:57 +05
Nmap scan report for challenge01.root.me.org (208.73.211.70)
Host is up (0.21s latency).
PORT STATE SERVICE
54013/tcp closed unknown

I don’t know whether i did it right, but i just guessed this ldap user tree. There was no option to retrieve all sub trees. I think broot force is the only option.