CEH Enumeration and System Hacking Practice Question

A security analyst wants to enumerate users and groups from a Windows domain controller using LDAP. Which of the following queries would return all objects of class 'user' from the domain 'example.com'?

⚠ Common exam trap

The trap is that candidates often choose Option D thinking the combined filter is more precise, but they fail to realize that (objectClass=user) alone is sufficient and that objectCategory=person is a Microsoft-specific attribute that is redundant and can cause issues in standard LDAP environments.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

ldapsearch -x -b "dc=example,dc=com" "(objectClass=user)"

The LDAP filter (objectClass=user) specifically retrieves all entries where the objectClass attribute equals 'user', which in Active Directory corresponds to user objects. Option A is incorrect because it searches for any object with a common name, not limiting to users. Option C is incorrect because objectClass=person includes contact objects as well. Option D is incorrect because it adds the condition objectCategory=person, which is a Microsoft-specific attribute and is redundant; it does not improve the query and may cause compatibility issues in standard LDAP environments.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
ldapsearch -x -b "dc=example,dc=com" "(cn=*)"
Why it's wrong here
This filter, using `(cn=*)`, attempts to retrieve all objects that possess a Common Name attribute. While many directory objects, including users, groups, and computers, have a `cn`, this query is too broad and does not specifically filter for user or group object classes. Consequently, it would return a large, unfiltered dataset containing various object types, making precise enumeration of users and groups inefficient and incomplete for the specific goal.
✓
ldapsearch -x -b "dc=example,dc=com" "(objectClass=user)"
Why this is correct
This is the correct and most precise filter for enumerating user objects within an LDAP directory, including Active Directory. The `(objectClass=user)` filter specifically targets entries classified as user accounts, ensuring that only relevant user objects are returned. This command effectively identifies and lists all user accounts under the specified base DN, fulfilling the requirement to enumerate users.
✗
ldapsearch -x -b "dc=example,dc=com" "(objectClass=person)"
Why it's wrong here
The `(objectClass=person)` filter is a more generic classification that includes user objects but also encompasses other human-related entries, such as contacts or non-login accounts. While it would return users, it also includes objects that are not active user accounts, leading to over-enumeration and inclusion of irrelevant data. This makes it less precise than `(objectClass=user)` for the specific task of enumerating active user accounts.
✗
ldapsearch -x -b "dc=example,dc=com" "(&(objectClass=user)(objectCategory=person))"
Why it's wrong here
This compound filter combines `(objectClass=user)` with `(objectCategory=person)`. While `objectClass=user` correctly identifies user accounts, `objectCategory=person` is a Microsoft Active Directory-specific attribute that is inherently true for user objects. Therefore, adding `(objectCategory=person)` is redundant in an Active Directory environment and provides no additional filtering benefit. Furthermore, this specific `objectCategory` attribute may not exist or function identically in non-Active Directory LDAP implementations, potentially causing compatibility issues or returning no results.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question