{"id":54159,"date":"2023-10-17T15:32:45","date_gmt":"2023-10-17T15:32:45","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35132\/Trench-Tales-The-College-Account-Takeover-That-Never-Happened.html"},"modified":"2023-10-17T15:32:45","modified_gmt":"2023-10-17T15:32:45","slug":"trench-tales-the-college-account-takeover-that-never-happened","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/trench-tales-the-college-account-takeover-that-never-happened\/","title":{"rendered":"Trench Tales: The College Account Takeover That Never Happened"},"content":{"rendered":"
    \n
  1. Disclaimer<\/a><\/li>\n
  2. Introduction<\/a><\/li>\n
  3. The Vulnerability<\/a><\/li>\n
  4. Methodology<\/a>\n
      \n
    1. Shodan<\/a><\/li>\n
    2. Ldapsearch<\/a><\/li>\n
    3. Bash<\/a><\/li>\n
    4. Python<\/a><\/li>\n<\/ol>\n<\/li>\n
    5. Ethical Dilemmas<\/a><\/li>\n
    6. Case Study \u2013 The College<\/a><\/li>\n
    7. Conclusion<\/a><\/li>\n<\/ol>\n

      Disclaimer<\/h2>\n

      All activities presented within this post have been conducted for research purposes. All efforts were made to disclose the findings responsibly to the owners. Where more intrusive tests were conducted, I made sure to contact the owners beforehand.<\/p>\n

      Introduction<\/h2>\n

      Recently, I embarked on a journey to scout the internet for one specific vulnerability. On the journey, I encountered ethical dilemmas, discovered critical vulnerabilities, and gained valuable insights through my experiences. The project started from a rather simple question, but ended revealing a lot more than I expected. You can find a simple, less technical description here: https:\/\/youtu.be\/WcFZd_68HVg?si=er-D3lgZ0CtRI8nq<\/a>. <\/p>\n

      The Vulnerability<\/h2>\n

      During the past year, I found myself fascinated with LDAP Anonymous Binding. In itself, it is not necessarily a misconfiguration or vulnerability, but rather a feature of LDAP, allowing clients to connect and search the directory (bind and search) without logging in. For instance, if the directory contains publicly accessible information that does not require authentication, such as a company\u2019s contact directory or public phone book, one may allow anonymous binds for read-only access to this information. Also, some older applications and devices may not support authentication when querying LDAP directories. In such cases, one may need to allow anonymous binds temporarily to ensure compatibility.<\/p>\n

      However, there is a possibility that LDAP Anonymous Binding is allowed even when the directory contains sensitive information. This can be a serious breach of confidentiality, as anyone can access the sensitive information behind the unprotected service. <\/p>\n

      Methodology<\/h2>\n

      This project\u2019s core questions were \u201cHow many servers allow LDAP Anonymous Binding?\u201d and \u201cWhat sort of information do they expose?\u201d. In order to answer these questions, I used the following tools\/utilities:<\/p>\n