LDAP User Enumaration using ldapsearch

UserEnum_LDAP.sh

#!/bin/bash
# Usage: ./UserEnum_LDAP.sh usernames.txt

# References:
# https://github.com/sensepost/UserEnum
# https://github.com/sensepost/UserEnum/blob/master/UserEnum_LDAP.py
# http://ldapwiki.com/wiki/LDAP%20ping
#
# Output: valid user will begin with E, otherwise will begin with F

LDAP_URI=ldap://127.0.0.1
DOMAIN=contoso.com

while IFS= read -r USERNAME
do
  RESULT=`ldapsearch -H $LDAP_URI -b '' -x -LLL -s base "(&(DnsDomain=$DOMAIN)(NtVer=\03\00\00\00)(User=$USERNAME)(AAC=\10\00\00\00))" NetLogon | grep -i ^NetLogon | awk '{print $2}' | cut -c 1`
  if [ "$RESULT" == "E" ]; then
    echo $USERNAME exists
  fi
done < "$1"