🧠 Active Directory - Credentials in Description Field

What is it?

• Concept: The AD user object description attribute is free-text, has no special ACL restrictions beyond standard object read access, and is visible to any authenticated user — a fine place to leave an admin note, and a very common place to find a password an admin or user left themselves as a reminder.
• Impact: Direct credential disclosure for the affected account, readable by anyone who can authenticate to the domain at all (often even lower-privilege than that).

How it works

description (and similarly info/comment) exist purely as free-text metadata fields with no built-in validation — nothing stops an administrator from typing a plaintext password into one while provisioning or troubleshooting an account, intending it as a private note. Unlike most sensitive AD attributes, description doesn’t require any special permission to read beyond ordinary object read access, which essentially every authenticated (and sometimes unauthenticated) principal has by default. Tools that enumerate users over SAMR/LDAP frequently surface this field automatically without it needing to be specifically requested.

Exploitation

Prerequisites

• Any authenticated domain credential (often even a Guest/low-privilege one is enough, since description isn’t specially protected)

Attack Vectors

# NetExec surfaces the description column automatically once authenticated
nxc smb <target> -u '<user>' -p '<pass>' --users
 
# Equivalent via raw LDAP query
ldapsearch -H ldap://<dc> -x -D '<user>@<domain>' -w '<pass>' -b "dc=<domain_component>,dc=<tld>" "(objectClass=user)" description

Notes

• Worth re-checking after every new credential gained during an engagement, not just once — some enumeration paths only reveal description once authenticated (a null/Guest session may not show it even when it can list usernames).
• Not limited to user objects — computer and group objects have the same field, and the same mistake happens there too.

Mitigation

• Fix: Never store credentials, hints, or other sensitive material in any AD attribute — treat description/info/comment fields as visible to anyone on the domain, because they effectively are.

Related Usage

File	Created
HTB - Cicada	Tuesday, July 21st 2026, 2:55:20 am

---

References:

• Passwords in AD User Comment/Description - HackTricks