timsonner Impacket Lookupsid
Purpose
Use this skill for focused SID-to-name enumeration against approved Windows targets.
Phase Fit
- Primary: Discovery and Reconnaissance, Threat Modeling and Test Planning
- Secondary: Vulnerability Analysis, Retest and Closure
Use When
- Need to understand what identity metadata a target leaks over RPC.
- Need to support later AD or privilege-path analysis.
- Need a lightweight enumeration path to confirm account discovery.
Avoid When
- The host is out of scope.
- Broader identity harvesting is not justified by the current phase objective.
Inputs
- Approved target host
- Anonymous or authorized credential context
- Narrow RID range or enumeration goal
Procedure
- Start with the narrowest RID scope that answers the question.
- Record only material identity exposure, not every object returned.
- Correlate results with other directory findings.
- Preserve the exact target and scope for retest.
- Treat the output as discovery context, not standalone impact proof.
Command Syntax
Replace sample targets with approved in-scope assets and authorized credentials.
# Enumerate SIDs with credentials
lookupsid.py contoso.com/auditor:'<password>'@10.10.10.10
# Unauthenticated attempt (null/guest session)
lookupsid.py -no-pass contoso.com/guest@10.10.10.10
# Limit SID brute-force range
lookupsid.py contoso.com/auditor:'<password>'@10.10.10.10 5000
# Pass-the-Hash
lookupsid.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.10
Evidence to Capture
- Identity metadata exposed by the target
- Exact host, auth context, and scope used
- Why the result matters to later attack-path analysis
Safety Boundaries
- Keep the scope limited to the approved host and discovery need.
- Do not treat raw identity lists as proof of compromise.