Samba LDB files

Theory

A Samba AD DC is Samba running the Active Directory Domain Controller role on Linux. In that mode, Samba is not just a file server: it also provides core AD services, including LDAP-backed directory services, a Kerberos KDC, and AD replication logic (DRSUAPI).

LDB - Samba's Embedded Database Layer

Internally, Samba stores AD data using LDB, an embedded LDAP-like database library. LDB is not fully LDAP-compliant by design, it is modular and uses compliance modules where needed. Under the hood, LDB stores its data in TDB (Trivial Database) files, giving it ACID-style transactional properties. This is why LDB files have a .ldb extension but internally behave as TDB-backed stores.

All security-sensitive LDB files live in Samba's private/ directory, which is readable only by root. The default location varies by installation method:

Key Files

sam.ldb is the main AD directory database for the DC role. It holds all domain objects — users, groups, computers, GPOs — along with their AD attributes. Two attributes are of direct interest for credential extraction:

• unicodePwd: the user's NT hash, stored as raw binary (16 bytes). Samba's LDB layer represents it base64-encoded with double-colon notation (::) in query output. The NT hash is an unsalted MD4 digest of the password encoded as UTF-16LE — identical in format to a Windows DC's NT hash and usable for Pass-the-Hash or offline cracking. This attribute is not readable via the LDAP protocol — it can only be accessed through direct file I/O on the DC.
• supplementalCredentials: a binary blob containing all long-term Kerberos encryption keys for the account (AES-256, AES-128, and — unless explicitly disabled — RC4/arcfour-hmac-md5). The RC4 Kerberos key is mathematically identical to the NT hash. These keys can be used to forge Kerberos tickets (Golden/Silver Ticket attacks).

secrets.ldb is a separate, schema-less local secret store used internally by Samba components. Unlike sam.ldb, it stores no schema (arbitrary data can be inserted), and it holds sensitive DC-side material: the machine account password, domain SID, trust account secrets, and DRSUAPI-related credentials. It is not the user password database.

Other notable files in private/:

• secrets.keytab — Kerberos keytab for DC service principals (LDAP, CIFS, HOST…)
• dns.keytab — Kerberos keytab for the DNS service principal
• krb5.conf — Kerberos realm configuration generated at provisioning time

Practice

All methods below require root access on the Samba AD DC, since the private/ directory is mode 700 and all files within it are mode 600.

# Dump sAMAccountName + unicodePwd for all user objects
ldbsearch -H /var/lib/samba/private/sam.ldb \
  '(objectClass=user)' \
  sAMAccountName unicodePwd

# Decode a single unicodePwd value to hex NT hash
echo -n "<base64_value>" | base64 -d | xxd -p | tr -d '\n'

export LDB_MODULES_PATH=/usr/lib/x86_64-linux-gnu/samba/ldb
# path varies by distro — use: find / -name "*.so" -path "*/samba/ldb*" 2>/dev/null

Resources

infosecwriteups.cominfosecwriteups.com