I had never seen this attack vector, the initial part is quite interesting, nice machine 
Initial Foothold
First I was in a HUGE rabbit hole using ldap****h, some have used Nmap and other enumeration tools in the protocol, the hashes of the users {crypto} are not very helpful, I was several days like this … the trick is to attack while being inside the machine, to ***** for a few minutes, and that result to analyze it in your world …
User
Following the above, you will see something interesting inside that, something similar to a kind of ****** … When you get one of the users, to reach the next user is to analyze the files of the house, it is difficult to say things without spoiler, some users have said interesting things in this thread …
Root
Once again analyze what is in front of your eyes, and see if those ******* allow you to bring the flag, you may enter another rabbit hole again …
Thanks to @Mezareph79
Luck!