Nmap ldap-rootdse NSE Script


This page contains detailed information about how to use the ldap-rootdse NSE script. For list of all NSE scripts, visit the Nmap NSE Library.

Script Overview

Script source code: https://github.com/nmap/nmap/tree/master/scripts/ldap-rootdse.nse
Script categories: discovery, safe
Target service / protocol: ldap, ldapssl, tcp, udp
Target network port(s): 389, 636
List of CVEs: -

Script Description

The ldap-rootdse.nse script retrieves the LDAP root DSA-specific Entry (DSE)

Ldap-rootdse NSE Script Arguments

The ldap-rootdse.nse script does not have any arguments.

Ldap-rootdse NSE Script Example Usage

Here's an example of how to use the ldap-rootdse.nse script:

nmap -p 389 --script ldap-rootdse <host>

Ldap-rootdse NSE Script Example Output

Here's a sample output from the ldap-rootdse.nse script:

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse:
|     currentTime: 20100112092616.0Z
|     subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=cqure,DC=net
|     dsServiceName: CN=NTDS Settings,CN=LDAPTEST001,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=cqure,DC=net
|     namingContexts: DC=cqure,DC=net
|     namingContexts: CN=Configuration,DC=cqure,DC=net
|     namingContexts: CN=Schema,CN=Configuration,DC=cqure,DC=net
|     namingContexts: DC=DomainDnsZones,DC=cqure,DC=net
|     namingContexts: DC=ForestDnsZones,DC=cqure,DC=net
|     namingContexts: DC=TAPI3Directory,DC=cqure,DC=net
|     defaultNamingContext: DC=cqure,DC=net
|     schemaNamingContext: CN=Schema,CN=Configuration,DC=cqure,DC=net
|     configurationNamingContext: CN=Configuration,DC=cqure,DC=net
|     rootDomainNamingContext: DC=cqure,DC=net
|     supportedControl: 1.2.840.113556.1.4.319
|     .
|     .
|     supportedControl: 1.2.840.113556.1.4.1948
|     supportedLDAPVersion: 3
|     supportedLDAPVersion: 2
|     supportedLDAPPolicies: MaxPoolThreads
|     supportedLDAPPolicies: MaxDatagramRecv
|     supportedLDAPPolicies: MaxReceiveBuffer
|     supportedLDAPPolicies: InitRecvTimeout
|     supportedLDAPPolicies: MaxConnections
|     supportedLDAPPolicies: MaxConnIdleTime
|     supportedLDAPPolicies: MaxPageSize
|     supportedLDAPPolicies: MaxQueryDuration
|     supportedLDAPPolicies: MaxTempTableSize
|     supportedLDAPPolicies: MaxResultSetSize
|     supportedLDAPPolicies: MaxNotificationPerConn
|     supportedLDAPPolicies: MaxValRange
|     highestCommittedUSN: 126991
|     supportedSASLMechanisms: GSSAPI
|     supportedSASLMechanisms: GSS-SPNEGO
|     supportedSASLMechanisms: EXTERNAL
|     supportedSASLMechanisms: DIGEST-MD5
|     dnsHostName: EDUSRV011.cqure.local
|     ldapServiceName: cqure.net:[email protected]
|     serverName: CN=EDUSRV011,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=cqure,DC=net
|     supportedCapabilities: 1.2.840.113556.1.4.800
|     supportedCapabilities: 1.2.840.113556.1.4.1670
|     supportedCapabilities: 1.2.840.113556.1.4.1791
|     isSynchronized: TRUE
|     isGlobalCatalogReady: TRUE
|     domainFunctionality: 0
|     forestFunctionality: 0
|_    domainControllerFunctionality: 2


The root DSE object may contain a number of different attributes as described in RFC 2251 section 3.4:
* namingContexts: naming contexts held in the server
* subschemaSubentry: subschema entries (or subentries) known by this server
* altServer: alternative servers in case this one is later unavailable.
* supportedExtension: list of supported extended operations.
* supportedControl: list of supported controls.
* supportedSASLMechanisms: list of supported SASL security features.
* supportedLDAPVersion: LDAP versions implemented by the server.

The above example, which contains a lot more information is from Windows 2003 accessible without authentication.
The same request against OpenLDAP will result in significantly less information.

The ldap-search script queries the root DSE for the namingContexts and/or defaultNamingContexts, which it sets as base
if no base object was specified

Credit goes out to Martin Swende who provided me with the initial code that got me started writing this.

Ldap-rootdse NSE Script Example XML Output

There is no sample XML output for this module. However, by providing the -oX <file> option, Nmap will produce a XML output and save it in the file.xml file.

Author

  • Patrik Karlsson

References

See Also

Related NSE scripts to the ldap-rootdse.nse script:

Visit Nmap NSE Library for more scripts.

Version

This page has been created based on Nmap version 7.92.