Command

sudo ldapdomaindump ldaps://192.168.150.128 -u 'MARVEL\\fcastle' -p Password1

• ldaps: Follows by domain controller’s IP address
• -u: Username
• -p: Password
• -o: Output

<aside> 💡

If the above command doesn’t work:

python3 -m ldapdomaindump ldaps://192.168.150.128 -u 'MARVEL\\fcastle' -p Password1

• -m: Tells python to run ldapdomaindump as a module instead of installed system-wide command
• This works if ldapdomaindump is installed in a directory that Python recognizes

ntlmrelayx vs. ldapdomaindump: Differences

</aside>

Output