LDAP connection reset by peer when BloodHound.py falls back to LDAPS

[kevinadhiguna]

When attempting to run bloodhound-python against a domain controller that requires LDAP signing, the tool fails when switching to LDAPS, producing a “Connection reset by peer” error. DNS resolution and port connectivity appear to be working correctly.

The command was something like:

bloodhound-python -u administrator -d admincomp.local -ns 192.168.17.3 -c all

I also could ping the DC from the machine I ran bloodhound in.

The error says:

INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc1.insecurity.local:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc1.insecurity.local
WARNING: LDAP Authentication is refused because LDAP signing is enabled. Trying to connect over LDAPS instead…
ldap3.core.exceptions.LDAPSocketOpenError: socket ssl wrapping error: [Errno 104] Connection reset by peer

I can confirm that the credential I entered was correct. Any help is appreciated

Verified DNS:

$ nslookup DC1.admincomp.local 192.168.17.3

# Output
Server: 192.168.17.3
Address: 192.168.17.3#53

Name: DC1.admincomp.local
Address: 192.168.17.3

Verified LDAPS connectivity:

$ nc -vz 192.168.17.3 636

# Output
192.168.17.3: inverse host lookup failed: Unknown host
(UNKNOWN) [192.168.17.3] 636 (ldaps) open

Expected Behavior

BloodHound.py should connect successfully over LDAPS (port 636) when LDAP signing is required, or provide a clearer diagnostic message if the TLS handshake fails.

[kuklycs]

I think I observed same behavior when using nxc with bloodhound-ce

[bandrel]

this could be due to the absence of --start-tls you can try this fork to test to see if it fixes your issues. #249