LDAPSearch Shadow Principals (PAM Trust)

Enumerate msDS-ShadowPrincipal objects to identify PAM trust shadow principals

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

ldapsearch

Category

Privilege Escalation / Trust Attacks

Platform

linux

Requires

Kerberos ticket

Protocols

LDAP, KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

ldapsearch -H ldap://<ip> -Y GSSAPI -b 'CN=Shadow Principal Configuration,CN=Services,CN=Configuration,<dc_dn>' '(objectClass=msDS-ShadowPrincipal)' msDS-ShadowPrincipalSid member name

Examples

ldapsearch -H ldap://192.168.101.1 -Y GSSAPI -b 'CN=Shadow Principal Configuration,CN=Services,CN=Configuration,DC=bastion,DC=local' '(objectClass=msDS-ShadowPrincipal)' msDS-ShadowPrincipalSid member name

Tags

ldapsearch ldap shadow-principal pam-trust trust enumeration

Related commands

• Impacket goldenPac (MS14-068) Exploit MS14-068 Kerberos privilege escalation to obtain Domain Admin via forged PAC
• Impacket LookupSID Enumerate domain SIDs and discover trust relationships via SID brute-forcing
• Impacket raiseChild Escalate from child domain DA to forest root DA via inter-realm Kerberos trust
• Inter-Realm Golden Ticket Forge a cross-domain Golden Ticket to escalate from child to parent domain
• NetExec LDAP Raise Child Escalate from child domain DA to forest root DA via inter-realm Kerberos trust abuse
• NetExec SMB NoPAC Check for and exploit the NoPAC (CVE-2021-42278/42287) Kerberos privilege escalation…
• NetExec SMB Zerologon Check for Zerologon (CVE-2020-1472) vulnerability — resets DC computer account password…