bof_ldap
Perform full LDAP read, write, and delete operations on Active Directory objects, including user, group, computer, and ACL management.
Instructions
LDAP-BOF: Full LDAP read/write/delete operations against Active Directory.
ENUMERATION (Read): ldap get-acl — Get ACL/security descriptor ldap get-attribute — Get specific attribute(s) ldap get-computers — List all domain computers ldap get-groups — List all domain groups ldap get-groupmembers — List members of a group ldap get-delegation — Get delegation config ldap get-domaininfo — Get domain info from rootDSE ldap get-maq — Get Machine Account Quota ldap get-object — Get all attributes of an object ldap get-rbcd — Get RBCD config ldap get-spn — Get SPNs ldap get-uac — Get UAC flags ldap get-users — List all domain users ldap get-usergroups — List groups a user is member of ldap get-writable — Find objects you have write access to
MODIFICATION (Write): ldap move-object — Move object to different OU ldap add-ace — Add ACE to DACL ldap add-attribute — Add value to attribute ldap add-computer [password] — Add computer to domain ldap add-delegation — Add delegation SPN ldap add-group [ou] — Add group ldap add-groupmember — Add member to group ldap add-ou — Add OU ldap add-rbcd — Add RBCD delegation ldap add-sidhistory — Add SID to sidHistory ldap add-spn — Add SPN ldap add-user [password] [ou] — Add user ldap add-uac — Add UAC flags ldap add-genericall — Add GenericAll ACE ldap add-genericwrite — Add GenericWrite ACE ldap add-dcsync — Add DCSync rights ldap add-asreproastable — Set DONT_REQ_PREAUTH ldap add-unconstrained — Enable unconstrained delegation ldap add-constrained — Set constrained delegation SPNs ldap set-attribute — Set/replace attribute ldap set-delegation — Set delegation SPNs ldap set-owner — Set object owner ldap set-spn — Set SPNs (replaces all) ldap set-password — Set/reset user password ldap set-uac — Set UAC flags (replaces all)
REMOVAL (Delete): ldap remove-ace — Remove ACE from DACL ldap remove-attribute [val] — Remove attribute/value ldap remove-delegation — Remove delegation SPN ldap remove-dcsync — Remove DCSync rights ldap remove-genericall — Remove GenericAll ACE ldap remove-genericwrite — Remove GenericWrite ACE ldap remove-groupmember — Remove group member ldap remove-object — Delete object from domain ldap remove-rbcd — Remove RBCD delegation ldap remove-spn — Remove SPN ldap remove-uac — Remove UAC flags
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| command | Yes | ||
| args | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |