p0dalirius/ldapmonitorMonitor creation, deletion and changes to LDAP objects live during your pentest or system administration!
| Feature | Python (.py) | CSharp (.exe) | Powershell (.ps1) |
|---|
| LDAPS support | ✔️ | ✔️ | ✔️ |
| Random delay in seconds between queries | ✔️ | ✔️ | ✔️ |
| Custom delay in seconds between queries | ✔️ | ✔️ | ✔️ |
| Save output to logfile | ✔️ | ✔️ | ✔️ |
Colored or not colored output with --no-colors | ✔️ | ❌ | ❌ |
| Custom page size for paged queries | ✔️ | ✔️ | ✔️ |
| Authenticate with user and password | ✔️ | ✔️ | ✔️ |
| Authenticate as current shell user | ❌ | ✔️ | ✔️ |
| Authenticate with LM:NT hashes | ✔️ | ❌ | ❌ |
| Authenticate with kerberos tickets | ✔️ | ❌ | ❌ |
| Option to ignore user logon events | ✔️ | ✔️ | ✔️ |
| Custom search base | ✔️ | ✔️ | ✔️ |
| Iterate over all naming contexts | ✔️ | ✔️ | ✔️ |
Here is a few use cases where this tool can be useful:
Detect account lockout in real time
Check if your privilege escalation worked (with ntlmrelay's --escalate-user option)
Detect when users are login in to know when to start a network poisoning.
LDAP paged queries returns pageSize results per page, and it takes approximately 1 second to query a page. Therefore your monitoring refresh rate is (number of LDAP objects // pageSize) seconds. On most domain controllers pageSize = 5000.
Pull requests are welcome. Feel free to open an issue if you want to add other features.
