Unable to run tool when domain user has empty password

[denevin]

Hi, is there a way to run the certipy-ad tool with a user who has an empty password?
I tried -no-pass, -p '' and -p "" and after it asks for password I pressed enter and it didn't work either.
The tool works with user who has password on same domain.

# certipy-ad find -u user1 -dc-ip 192.168.1.1 -no-pass -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[+] Authenticating to LDAP server
[-] Got error: NTLM needs domain\username and a password
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certipy/entry.py", line 60, in main
    actions[options.action](options)
  File "/usr/lib/python3/dist-packages/certipy/commands/parsers/find.py", line 12, in entry
    find.entry(options)
  File "/usr/lib/python3/dist-packages/certipy/commands/find.py", line 1179, in entry
    find.find()
  File "/usr/lib/python3/dist-packages/certipy/commands/find.py", line 165, in find
    connection = self.connection
                 ^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certipy/commands/find.py", line 124, in connection
    self._connection.connect()
  File "/usr/lib/python3/dist-packages/certipy/lib/ldap.py", line 77, in connect
    self.connect(version=ssl.PROTOCOL_TLSv1_2)
  File "/usr/lib/python3/dist-packages/certipy/lib/ldap.py", line 136, in connect
    bind_result = ldap_conn.bind()
                  ^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/ldap3/core/connection.py", line 635, in bind
    raise LDAPUnknownAuthenticationMethodError(self.last_error)
ldap3.core.exceptions.LDAPUnknownAuthenticationMethodError: NTLM needs domain\username and a password

# certipy-ad find -u user1 -dc-ip 192.168.1.1 -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)
Password: <=== pressed enter here
[+] Authenticating to LDAP server
[-] Got error: NTLM needs domain\username and a password
......

# certipy-ad find -u user1 -p '' -dc-ip 192.168.1.1 -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)
Password: <=== pressed enter here
[+] Authenticating to LDAP server
[-] Got error: NTLM needs domain\username and a password
......

[ThePirateWhoSmellsOfSunflowers]

Hi,

Maybe you can try with a empty NT hash instead: 31d6cfe0d16ae931b73c59d7e0c089c0

🌻

[denevin]

Hi,

Maybe you can try with a empty NT hash instead: 31d6cfe0d16ae931b73c59d7e0c089c0

🌻

That worked thanks!