#!/usr/bin/env bash
# Active Directory enumeration wrapper using common tools.
# Usage: bash scripts/ad_enum.sh <domain> <dc_ip> [--user USER --pass PASS]
set -euo pipefail

DOMAIN="${1:?Usage: $0 <domain> <dc_ip> [--user USER --pass PASS]}"
DC_IP="${2:?Provide DC IP address}"
USER="${3:-}"
PASS="${4:-}"

echo "=== AD Enumeration: $DOMAIN ($DC_IP) ==="

if [ -n "$USER" ] && [ -n "$PASS" ]; then
  CREDS="-u $USER -p $PASS"
  echo "Authenticated as: $USER"
else
  CREDS=""
  echo "Unauthenticated enumeration"
fi

echo ""
echo "--- DNS Enumeration ---"
dig @"$DC_IP" "$DOMAIN" ANY +short 2>/dev/null || echo "  DNS query failed"

echo ""
echo "--- LDAP Null Bind ---"
ldapsearch -x -H "ldap://$DC_IP" -b "DC=$(echo "$DOMAIN" | sed 's/\./,DC=/g')" \
  "(objectClass=domain)" 2>/dev/null | head -20 || echo "  LDAP null bind failed (expected)"

echo ""
echo "--- SMB Shares ---"
if command -v smbclient &>/dev/null; then
  smbclient -L "//$DC_IP" -N 2>/dev/null | grep -i "disk\|ipc" || echo "  No anonymous shares"
elif command -v nxc &>/dev/null; then
  nxc smb "$DC_IP" --shares $CREDS 2>/dev/null || echo "  NetExec not available"
fi

echo ""
echo "--- RPC Enumeration ---"
rpcclient -U "" -N "$DC_IP" -c "enumdomusers" 2>/dev/null | head -20 || echo "  RPC null session denied (expected)"

echo ""
echo "Next steps: BloodHound collection, Kerberoasting, AS-REP roasting"
