Command Manager

NetExec LDAP DACL Read

Read DACL entries on an AD object to identify abusable ACL permissions

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
nxc
Category
Privilege Escalation / ACL / DACL Abuse
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap '<ip>' -u '<user>' -p '<password>' -M daclread -o TARGET='<target>' ACTION=read

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc ldap '<ip>' -u '<user>' -H '<hash>' -M daclread -o TARGET='<target>' ACTION=read

Kerberos Ticket requires Kerberos ticket

nxc ldap '<ip>' -u '<user>' --use-kcache -M daclread -o TARGET='<target>' ACTION=read

Examples

nxc ldap '192.168.1.100' -u 'user' -p 'password' -M daclread -o TARGET='Domain Admins' ACTION=read

Tags

nxc ldap dacl acl enumeration privilege-escalation