skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-freeipa

Enumerates and attacks FreeIPA domains via LDAP, Kerberos tickets, HBAC rules, and delegation paths.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#attack graph#linux security#Kerberos#Privilege escalation#freeipa#ldap enumeration
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-freeipa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-freeipa
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/linux-hardening/pentesting-freeipa
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-freeipa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

FreeIPA environments are frequently under-enumerated during authorized penetration tests because they appear to be simple LDAP plus Kerberos setups, causing testers to miss high-impact attack paths hidden in HBAC rules, sudo policies, delegation attributes, and reusable Kerberos tickets.

Core Features & Use Cases

  • Anonymous and Authenticated Enumeration: Dump users, groups, hosts, and policies via anonymous LDAP binds or GSSAPI-authenticated queries with ldapsearch and the ipa CLI.
  • Kerberos Credential Abuse: Reuse captured CCACHE tickets, extract tickets from the Linux keyring with Tickey, and obtain TGTs from keytab files without passwords.
  • Attack Graph and Delegation Analysis: Build BloodHound-style graphs with IPAHound, analyze HBAC and sudo rules for privilege escalation, and execute PKINIT/S4U2proxy delegation takeovers.
  • Use Case: During an authorized engagement against a FreeIPA-joined Linux estate, reuse a captured CCACHE ticket, map CanSSH and CanSUDO edges to the IPA server, and dump all domain password hashes from id2entry.db to demonstrate full domain compromise.

Quick Start

Ask the AI to enumerate the FreeIPA domain at ipa.domain.local starting with an anonymous LDAP bind and then analyze HBAC and sudo rules for privilege escalation paths.

Frequently Asked Questions about pentesting-freeipa

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate a FreeIPA domain without credentials?▼

FreeIPA allows anonymous LDAP binds by default, so ldapsearch -x -h <ipa-server> -b "dc=domain,dc=local" returns users, groups, and hosts without credentials. The FreeIPA web UI on port 443 exposes similar directory data.

How to reuse a captured Kerberos CCACHE ticket on Linux?▼

Set the KRB5CCNAME environment variable to the ticket file path, for example export KRB5CCNAME=/tmp/krb5cc_1000, then verify with klist. Subsequent commands like ipa user-find authenticate with the cached ticket and require no password.

What is IPAHound and how does it compare to BloodHound?▼

IPAHound is a BloodHound-style collector that graphs FreeIPA attack paths into Neo4j, surfacing edges like CanSSH, CanSUDO, ReadKerberosKey, ForceChangePassword, and AddRBCD. It serves the same role BloodHound plays for Active Directory but targets Unix FreeIPA domains.

Can I get a Kerberos TGT from a keytab file without a password?▼

Yes, keytab files contain principals and encrypted keys, so kinit -kt /etc/krb5.keytab host/$(hostname -f) obtains a TGT without any password. Use klist -kt first to list the principals stored in the keytab.

Why is a sudo rule with !authenticate on the IPA server critical?▼

A sudo rule with ipaSudoOpt: !authenticate on the IPA server grants passwordless root on the KDC, letting an attacker read the id2entry.db directory database. Running dbscan on that file dumps every user's userPassword and ipaNTHash, compromising the entire domain.

When should FreeIPA delegation attributes be reviewed during a pentest?▼

Review delegation attributes whenever you control a computer or service account, since ipaAllowedToPerform;write_keys, write_delegation, and IPAKrbOkToAuthAsDelegate enable PKINIT certificate injection and S4U2proxy impersonation. These paths can yield admin-level LDAP access without knowing any user password.

Related Skills

Explore More Software Engineering Skills→
SnailSploitSnailSploit
2.9k

initial-access

Detail initial access techniques including phishing and credential stuffing mapped to MITRE ATT&CK TA0001.

Community
Advanced
rocklambrosrocklambros
2

writing-pentest-finding

Generate client-deliverable penetration-test findings with CVSS v3.1 vectors and remediation.

Community
Advanced
hypnguyen1209hypnguyen1209
338

active-directory-attack

Enumerate Active Directory components and map attack paths with BloodHound.

Community
Advanced
noname300989noname300989

ad-offensive

Orchestrate Active Directory offensive security operations with BloodHound, Impacket, and CrackMapExec.

Community
Advanced