LDIFToBloodHound

A Windows tool that converts LDIF files (from ldapsearch) to BloodHound CE compatible JSON files with full ACL parsing.

Why This Tool?

When performing Active Directory assessments through restricted network paths (SOCKS proxies, port forwarding, etc.), tools like SharpHound or bloodhound-python often fail due to DNS resolution issues or connectivity problems.

ldapsearch works reliably through proxies, but its output (LDIF format) isn't compatible with BloodHound. This tool bridges that gap by:

1. Parsing LDIF files from ldapsearch
2. Decoding binary nTSecurityDescriptor attributes using Windows APIs
3. Extracting ACEs (Access Control Entries) for attack path analysis
4. Outputting BloodHound CE v6 compatible JSON files

Features

Feature	Description
Full ACL Parsing	Extracts Owns, GenericAll, WriteDacl, DCSync, AddMember, etc.
Binary SD Decoding	Uses Windows RawSecurityDescriptor for accurate parsing
BloodHound CE v6	Outputs modern BloodHound format
All Object Types	Users, Computers, Groups, Domains, OUs, GPOs, Containers
ADCS Support	Enterprise CAs, Root CAs, AIA CAs, NTAuth Stores, Certificate Templates
Group Memberships	Resolves member DNs to SIDs
UAC Flag Parsing	Delegation, Kerberoastable, AS-REP roastable detection

Prerequisites

• Windows OS (required for ACL parsing)
• LDIF file with nTSecurityDescriptor attribute

Note: The published executable is self-contained - no .NET runtime installation required.

Quick Start

Step 1: Collect LDIF with ACLs

From your Linux attack box (through proxychains/SOCKS):

Domain Objects (Users, Computers, Groups, OUs, GPOs)

proxychains ldapsearch -x -H ldap://DC_IP -D "user@domain.com" -w 'password' \
  -b "DC=domain,DC=com" \
  -E pr=10000/noprompt \
  -E '!1.2.840.113556.1.4.801=::MAMCAQc=' \
  "(objectClass=*)" "*" nTSecurityDescriptor > ad_dump.ldif

ADCS Objects (Certificate Templates, CAs, NTAuth Store)

proxychains ldapsearch -x -H ldap://DC_IP -D "user@domain.com" -w 'password' \
  -b "CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com" \
  -E pr=10000/noprompt \
  -E '!1.2.840.113556.1.4.801=::MAMCAQc=' \
  "(objectClass=*)" "*" nTSecurityDescriptor cACertificate >> ad_dump.ldif

Note: Use >> to append ADCS objects to the same file.

Important flags:

• -E pr=10000/noprompt - Paged results (handles large domains)
• -E '!1.2.840.113556.1.4.801=::MAMCAQc=' - SD_FLAGS control to retrieve security descriptors
• nTSecurityDescriptor - Explicitly request the ACL attribute
• cACertificate - Required for certificate thumbprint extraction (ADCS only)

Step 2: Transfer and Convert

Transfer the LDIF file to a Windows machine and run:

LDIFToBloodHound.exe ad_dump.ldif ./bloodhound_output

Step 3: Import into BloodHound

Import the generated JSON files into BloodHound CE.

Usage

LDIFToBloodHound.exe <ldif_file> [output_dir]

Arguments:
  ldif_file    Path to the LDIF file from ldapsearch
  output_dir   Output directory for JSON files (default: ./bloodhound_output)

Example:
  LDIFToBloodHound.exe ad_dump.ldif C:\temp\bloodhound

Output Files

bloodhound_output/
├── 20231201120000_users.json
├── 20231201120000_computers.json
├── 20231201120000_groups.json
├── 20231201120000_domains.json
├── 20231201120000_ous.json
├── 20231201120000_gpos.json
├── 20231201120000_containers.json
├── 20231201120000_certtemplates.json
├── 20231201120000_enterprisecas.json
├── 20231201120000_rootcas.json
├── 20231201120000_aiacas.json
└── 20231201120000_ntauthstores.json

ACL Rights Extracted

Right	Description
Owns	Object ownership
GenericAll	Full control
GenericWrite	Write all properties
WriteDacl	Modify permissions
WriteOwner	Change ownership
AllExtendedRights	All extended rights (includes ForceChangePassword)
ForceChangePassword	Reset password without knowing current
GetChanges	DCSync (partial)
GetChangesAll	DCSync (full)
AddMember	Add members to group
AddSelf	Add self to group
AddKeyCredentialLink	Shadow Credentials attack
WriteSPN	Targeted Kerberoasting
Enroll	Certificate enrollment rights
AutoEnroll	Automatic certificate enrollment
ManageCA	CA management rights
ManageCertificates	Certificate management rights

Building from Source

git clone https://github.com/kypvas/LDIFToBloodHound.git
cd LDIFToBloodHound
dotnet publish -c Release

Output: bin/Release/net8.0-windows/win-x64/publish/LDIFToBloodHound.exe

This creates a single self-contained executable (~65MB) that includes all dependencies. No .NET runtime installation required on target machine.

How It Works

┌─────────────────────────────────────────────────────────────────┐
│                      LDIFToBloodHound                           │
├─────────────────────────────────────────────────────────────────┤
│  1. Parse LDIF file                                             │
│     └─ Handle base64 encoded attributes                         │
│     └─ Handle multi-valued attributes                           │
│     └─ Handle continuation lines                                │
├─────────────────────────────────────────────────────────────────┤
│  2. Build DN → SID mappings                                     │
│     └─ Resolve group members                                    │
│     └─ Determine object types                                   │
├─────────────────────────────────────────────────────────────────┤
│  3. Parse nTSecurityDescriptor (Windows API)                    │
│     └─ RawSecurityDescriptor class                              │
│     └─ Extract Owner SID                                        │
│     └─ Process DACL entries                                     │
│        └─ CommonAce: GenericAll, WriteDacl, WriteOwner          │
│        └─ ObjectAce: Extended rights, Property writes           │
├─────────────────────────────────────────────────────────────────┤
│  4. Output BloodHound v6 JSON                                   │
│     └─ Users, Computers, Groups, Domains, OUs, GPOs, Containers │
│     └─ ADCS: CertTemplates, EnterpriseCAs, RootCAs, AIACAs      │
│     └─ Full ACE arrays for attack path analysis                 │
└─────────────────────────────────────────────────────────────────┘

ADCS Support

The tool fully supports Active Directory Certificate Services (ADCS) objects for ESC attack path analysis:

Object Type	Description	Key Properties
Certificate Templates	PKI certificate templates	EKUs, enrollment flags, name flags, schema version
Enterprise CAs	Issuing certificate authorities	Enabled templates, hosting computer, CA security
Root CAs	Root certificate authorities	Certificate chain, thumbprints
AIA CAs	Authority Information Access CAs	Cross-certificate pairs, cert chain
NTAuth Stores	NTAuth certificate store	Trusted CA thumbprints

ADCS Properties Parsed

• Certificate Templates: enrolleesuppliessubject, nosecurityextension, authenticationenabled, requiresmanagerapproval, EKUs
• Enterprise CAs: HostingComputer, CARegistryData, EnabledCertTemplates, certificate thumbprints
• All ADCS Objects: Full ACL parsing including Enroll, AutoEnroll, ManageCA rights

Use Cases

1. Restricted Network Access - When you only have SOCKS proxy access and other tools fail
2. Stealth - ldapsearch generates less suspicious traffic than specialized AD tools
3. Offline Analysis - Collect LDIF once, convert and analyze later
4. Backup Collection - Secondary collection method when primary tools fail

Limitations

• Requires Windows for ACL parsing (uses .NET RawSecurityDescriptor)
• LDIF must include nTSecurityDescriptor attribute (use the SD_FLAGS control)
• No session collection (requires SMB access to computers)
• No local group collection (requires remote registry/SAM access)

Troubleshooting

"No ACLs in output"

Make sure your ldapsearch command includes:

• -E '!1.2.840.113556.1.4.801=::MAMCAQc=' - SD_FLAGS control
• nTSecurityDescriptor - Explicit attribute request

"Failed to parse ACL for..."

Some objects may have malformed security descriptors. These are logged and skipped.

"No objects parsed"

Check your LDIF file:

• Remove any "ProxyChains" header lines
• Ensure entries are separated by blank lines
• Verify DN attributes are present

Legal Disclaimer

This tool is provided for authorized security testing and research only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before using this tool.

License

This project is licensed under the GNU General Public License v3.0.

Credits

Inspired by the need to bridge the gap between reliable LDAP collection through restricted networks and BloodHound's powerful attack path analysis.