Update ldap.py

[commandermoon]

Fixes the Failed to authenticate to LDAP. Invalid Credentials error when using known good credentials

[kostrin]

There is something weird going on here. I have 2 different domains I was testing. One was working and the other was broken with the original code. I used this new code and the working one went to broken and the broken one was fixed. This is not quite the right fix but something is wrong in the original code. Something to do with how the password is represented.

[commandermoon]

Interesting. I can submit a modified PR with an extra check that tries both methods. I'll also check logs on the DC to see what's happening on that side.

[kostrin]

After a little troubleshooting it seems like one of my domains wants "authentication=ldap3.NTLM" and the domain removed and the other needs the authentication line. It might be a domain specific problem for me.

[commandermoon]

What OS is the DC running? And domain/forest function levels?

[commandermoon]

So I just did some testing and was able to get both versions working on my test lab but received no logs on bad logins with my code. With the current code 2 different logons are recorded. Both have NtLmSsp as the logon process, NTLM as the auth package, and NTLM V2 as the package name, but one has key length 0 and the other 128. It also reports the hostname of my attack VM in the one with key length 0. My code always has key length set to 128 and doesn't report the hostname. I'd be curious to see the difference in logs on your two environments with the different versions.

[ActivateDZA]

I am getting this error message now. Certipy main worked on my last engagement but now it is failing even though the credentials are correct I used LDAP ADMIN and it connected without an issue.

I tested your copy @commandermoon and I get the same error message.

[pgormington-r7]

@ActivateDZA Do you have the password or trying to use a hash? I've been having issues getting it to run with a hash regardless of the LDAP config

[ActivateDZA]

@ActivateDZA Do you have the password or trying to use a hash? I've been having issues getting it to run with a hash regardless of the LDAP config

I use https://github.com/secure-77/Certipy-Docker and got it working I used the -scheme flag and set it to ldap as ldaps was the one giving me issues.