Impossible to modify user password whereas `ForceChangedPassword` is present
Opened this issue · 4 comments
I'm experiencing an issue with the ldeep
tool when attempting to change user passwords, which works flawlessly with bloodyAD
. Below are the details of the commands used and the error encountered.
ldeep ldap -d "dev.com" -s ldap://172.16.172.52 -u "adminweb" -p "aaaadvdfdgdfh" modify_password 'nina' 's3curepassw0rd!'
It failed:
[!] Unable to change nina's password, check privileges or try with ldaps://
Whereas with bloodyAD
it is totally fine:
bloodyAD --host "172.16.172.52" -d "dev.com" -u "adminweb" -p "aaaadvdfdgdfh" set password 'nina' 's3curepassw0rd!'
Considering the success of the password change using bloodyAD, perhaps ldeep could benefit from integrating a similar method for password modifications. The relevant method in bloodyAD can be found here.
@n3rada did you try with LDAPS as suggested ? Most tools will attempt a first connection through LDAPS and thus succeed. But you used an LDAP connection and I would not be surprised that the server requires password changes to be performed over a secured channel.
Maybe we could default to LDAPS (which we don't at the time) but here you specifically requested LDAP.
I tried LDAPS and it didn't work either. Have you checked the mentioned code block of bloodyAD
that works?
I could but what I would be missing is the configuration of the Active Directory you were working against. I'd like to implement a change but I need to test it against something.
Unfortunately, I didn't control this Active Directory domain. It was a challenge. 🥲
The only thing I know for sure is that it worked with bloodyAD
. To test, you can try to set the ForceChangePassword
right on a user (ExtendedRight
on User-Force-Change-Password
object type).