During the APT campaign or red teaming activities, there is a scenario where two endpoint devices can't talk directly to each other. However and because of both stations are members of Active Directory / FreeIPA Linux Domain Controller Environment, they both can connect to the same LDAP ports, where the possibility exists to upload and download encoded data by utilizing well-known LDAP user attributes. Now, what is even more surprising, based on FreeIPA example, there is pretty much no length restriction for some attribute values, which means we can use ex. 'gecos' attribute as a hidden and unlimited storage space to send/upload data and bypass FW/IDS/IPS/segmentation protection. I will show you also an example of an unexpected OOM-based Remote Denial of Service attack against FreeIPA ns-slapd daemon I found during a research. The talk is dedicated to showing you typical LDAP security misconfigurations as well as insights of powerful AD/FreeIPA LDAP C2 / exfiltration techniques that allows for bypassing access controls and using your Domain Controllers to act as a central communication point for all your pwned internal systems. In the end, we will consider how to detect the above attacks by using better logging, LDAP traffic decoders and doing some critical changes in LDAP configurations.