Add standalone --directory UDS corporate-directory harvest

README.md

@@ -77,21 +77,29 @@ Extract usernames via CUCM UDS API:
 ./thief.py -H <CUCM Server> --userenum
 ```
 
-`--userenum` also harvests the full corporate directory from `/cucm-uds/users` — names, phone numbers, email, department, title, manager, and the per-user UUID — and stores it in the database (`uds_directory` table). This is the same anonymously-readable data phones use for the Directory button, so it works without credentials. View it later with `--show-db`, and when `--csv FILE` is supplied the directory is written to a companion `FILE-directory.csv` alongside the usernames `outfile`.
+`--userenum` also harvests the full corporate directory from `/cucm-uds/users` — names (including nickname), phone/home/mobile/pager numbers, email, directory URI, MS URI, department, title, manager, and the per-user UUID — and stores it in the database (`uds_directory` table). This is the same anonymously-readable data phones use for the Directory button, so it works without credentials. View it later with `--show-db`. The directory is always written to `cucm_directory.csv` (override with `--directory-outfile`).
 
-### Authenticated Device Discovery
+### Harvest the unauthenticated directory (`--directory`)
 
-Authenticate to the UDS API with a single end-user credential, enumerate **all** users from `/cucm-uds/users`, then query each user's associated SEP devices with that one credential. The discovered SEPs are deduped, and every config is downloaded and parsed for credentials:
+Pull the CUCM corporate directory from the unauthenticated UDS endpoint
+`/cucm-uds/users`, without the device probing, config downloads, or password
+spraying that `--userenum` performs. Every field the endpoint exposes is
+captured: username, first/middle/last/nick/display name, extension
+(`phoneNumber`), home/mobile/pager numbers, email, directory URI, MS URI,
+department, title, manager, and the per-user UUID.
 
 ```bash
-./thief.py -H <CUCM Server> --uds-devices --uds-user jdoe --uds-password 'Passw0rd!'
+uv run thief --directory -H <cucm-host>
 ```
 
-Authorization reality: a standard end user can usually only read their own record, so on a strict server most users return *denied* and you mainly recover the authenticated user's own devices; on permissive or privileged setups you get the full set. The run prints an ok/denied/error tally so you can see how the server responded.
+Results are always written to `cucm_directory.csv` (override with
+`--directory-outfile`), printed as a console summary table, and stored in the
+`uds_directory` table unless `--no-db` is set.
 
-For each user the sweep queries **both** `/cucm-uds/user/{id}` and `/cucm-uds/user/{id}/devices` and unions the SEP names, so a host that misconfigures authorization on one endpoint but not the other still yields devices. This roughly doubles the request volume per user — tune with `-T/--threads`.
-
-`--uds-devices` requires `-H/--host`, `--uds-user`, and `--uds-password`. It needs **only end-user credentials** — no CCM Admin or AXL access is required. It honors `--uds-port` (default: 8443), `--no-db`, and `-T/--threads` for sweep concurrency.
+**Note on DIDs:** the unauthenticated UDS directory has no dedicated DID field.
+The `phoneNumber` element is the directory number / extension, which in some
+dial plans is itself the full DID. True external DIDs require authenticated AXL
+access and are out of scope for this unauthenticated path.
 
 ### Password Spray
 
@@ -186,13 +194,12 @@ Export to CSV:
 ### Attack Options
 - `-b, --brute-mac`: Brute force MAC variations (4,096 combinations per phone). If no `-p` phones are given, reuses MAC prefixes discovered on a previous scan from the database (unless `--no-db`)
 - `--force`: Bypass cache and force re-download of all configuration files
-- `--userenum`: Extract usernames via CUCM User Data Services (UDS) API (paginates the full directory) and harvest the full directory records (names, phone numbers, email, department, title, manager, UUID) into the `uds_directory` table; with `--csv FILE` also writes a companion `FILE-directory.csv`
+- `--userenum`: Extract usernames via CUCM User Data Services (UDS) API (paginates the full directory) and harvest the full directory records (names incl. nickname, phone/home/mobile/pager numbers, email, directory URI, MS URI, department, title, manager, UUID) into the `uds_directory` table; always writes `cucm_directory.csv` (override with `--directory-outfile`)
+- `--directory`: Harvest the unauthenticated CUCM corporate directory from `/cucm-uds/users` without any device probing or config downloads — requires `-H`; always writes `cucm_directory.csv` (override with `--directory-outfile`), prints a console table, and stores to `uds_directory` unless `--no-db`
+- `--directory-outfile FILENAME`: Override the default CSV output path for `--directory` and `--userenum` (default: `cucm_directory.csv`)
 - `--servers`: Enumerate CUCM cluster members (hostnames + IPs) via UDS `/cucm-uds/servers` — requires `-H`
 - `--http`: Use HTTP (port 6970) as the primary config download protocol with TFTP fallback (default: TFTP first, HTTP fallback)
-- `--uds-port PORT`: Override the CUCM UDS API HTTPS port for `--userenum` (default: 8443)
-- `--uds-devices`: Authenticate to the UDS API with one end-user credential, enumerate **all** users, query each user's associated SEP devices with that credential, then dedupe and download + parse every discovered config (requires `-H`, `--uds-user`, and `--uds-password`; needs only end-user credentials — no admin/AXL access; prints an ok/denied/error tally)
-- `--uds-user USERNAME`: End-user username for `--uds-devices` authentication
-- `--uds-password PASSWORD`: End-user password for `--uds-devices` authentication
+- `--uds-port PORT`: Override the CUCM UDS API HTTPS port for `--userenum`, `--directory`, and `--servers` (default: 8443)
 - `--spray`: Password-spray the UDS API (requires `-H`; mutually exclusive with `--brute-mac`)
 - `--spray-password PASSWORD`: Single password to spray across all eligible users
 - `-P, --passwords FILE`: Password list file; sprays each password in turn, sleeping ~1h between rounds