lookupsid.py: Enumerate Users and SIDs via RID Cycling SMB

lookupsid.py — RID Cycling and User Enumeration via SMB with Impacket #

lookupsid Enumerates Windows users and groups by iterating RIDs via MS-LSAT on port 445—without touching LDAP. Works with valid credentials, guest accounts, or in some cases null sessions. Great when port 389 is filtered or you don't have domain credentials.

lookupsid.py is part of Packet and uses the MS-LSAT (Local Security Authority) protocol via SMB to resolve SIDs to account names. The technique is called RID cycling: starts from the domain SID, incrementally adds the RID (500, 501, 502…) and asks the system to resolve it into a name.

Official reference: fortra/impacket — lookupsid.py

Technical insight RID cycling: The Hacker Recipes — SID/RID Enumeration

Concept: RID cycling #

Each account in Windows has a SID with this format:

text


S-1-5-21-XXXXXXX-YYYYYYY-ZZZZZZZ-RID

│         └──────────────────────┘  └─ Relativo all'account

│              SID del dominio

└─ Prefisso fisso Windows NT

The fixed RIDs you already know:

| RID | Account |

|—–|———|

| 500 | Administrator |

| 501 | Guest |

| 502 | krbtgt (DC only) |

| 512 | Domain Admins |

| 513 | Domain Users |

| 514 | Domain Guests |

| 515 | Domain Computers |

| 516 | Domain Controllers |

| 518 | Admins Schema |

| 519 | Enterprise Admins |

| 1000+ | User/Computer Accounts Created |

lookupsid.py starts from RID 1 and arrives up to maxRid specified (default 4000), prompting the system to resolve each SID — and printing the name when it finds a valid account.

Syntax and options #

bash


impacket-lookupsid [opzioni] [[dominio/]utente[:password]@]target [maxRid]

| Option | Description |

|———|————-|

| maxRid | Maximum RID to test (default: 4000) |

| -domain-sids | Enumerate domain SIDs (query DC) |

| -target-ip IP | Target IP (if name doesn't resolve) |

| -port PORT | SMB Port (default: 445) |

| -hashes LM:NT | Pass-the-Hash |

| -k | Kerberos |

| -no-pass | Don't ask for password (for guest/null) |

| -debug | Verbose Output |

| -ts | Add timestamp to output |

Practical use #

With domain credentials #

bash


impacket-lookupsid corp.local/user:Password123@10.10.10.5



# Con maxRid aumentato per domini grandi

impacket-lookupsid corp.local/user:Password123@10.10.10.5 10000



# Pass-the-Hash

impacket-lookupsid -hashes :NThash corp.local/user@10.10.10.5

Null session / Guest account — without password #

This is the main advantage of GetADUsers.py and samrdump.py : in certain legacy or guest account-enabled environments, you can enumerate users without any credentials.

bash


# Null session (ambienti legacy, Samba)

impacket-lookupsid ''@10.10.10.5



# Guest account — molto comune su HTB e alcuni ambienti reali

impacket-lookupsid 'corp.local/guest'@10.10.10.5 -no-pass



# Senza dominio (autenticazione locale)

impacket-lookupsid 'guest'@10.10.10.5 -no-pass



# Con maxRid esplicito

impacket-lookupsid corp.local/guest@10.10.10.5 -no-pass 5000

Target IP separated from name #

bash


impacket-lookupsid corp.local/user:pass@DC01 -target-ip 10.10.10.5

Kerberos #

bash


export KRB5CCNAME=/path/to/ticket.ccache

impacket-lookupsid -k -no-pass corp.local/user@DC01.corp.local

Output and how to read it #

text


[*] Brute forcing SIDs at 10.10.10.5

[*] StringBinding ncacn_np:10.10.10.5[\pipe\lsarpc]

[*] Domain SID is: S-1-5-21-2725560159-1428537661-1240357446



500: CORP\Administrator (SidTypeUser)

501: CORP\Guest (SidTypeUser)

502: CORP\krbtgt (SidTypeUser)

512: CORP\Domain Admins (SidTypeGroup)

513: CORP\Domain Users (SidTypeGroup)

514: CORP\Domain Guests (SidTypeGroup)

515: CORP\Domain Computers (SidTypeGroup)

519: CORP\Enterprise Admins (SidTypeGroup)

1000: CORP\DC01$ (SidTypeUser)

1101: CORP\john.doe (SidTypeUser)

1102: CORP\svc_sql (SidTypeUser)

1103: CORP\helpdesk (SidTypeUser)

1104: CORP\WS01$ (SidTypeUser)

Main SidTypes:

| SidType | What it indicates |

|———|————|

| SidTypeUser | User or computer account ($) |

| SidTypeGroup | Global Group (Domain Admins, etc.) |

| SidTypeAlias | Builtin local group (Administrators, Backup Operators) |

| SidTypeWellKnownGroup | Known default group (Everyone, SYSTEM) |

| SidTypeDomain | The domain itself |

Extract the domain SID #

The domain SID is the first thing that lookupsid prints — and it is a fundamental value for building Kerberos tickets (Golden Ticket, Silver Ticket).

bash


# Estrai solo il SID del dominio dall'output

impacket-lookupsid corp.local/user:pass@10.10.10.5 | grep "Domain SID"

# [*] Domain SID is: S-1-5-21-2725560159-1428537661-1240357446



# Salva il SID per usarlo dopo

DOMAIN_SID=$(impacket-lookupsid corp.local/user:pass@10.10.10.5 2>/dev/null | \

  grep "Domain SID" | awk '{print $NF}')

echo $DOMAIN_SID

Then you use the SID in combination with the krbtgt hash for the Golden Ticket.

Extract only usernames for wordlist #

bash


# Salva tutto l'output

impacket-lookupsid corp.local/guest@10.10.10.5 -no-pass > /tmp/lookupsid_raw.txt



# Filtra solo utenti reali (SidTypeUser, escludi computer account con $)

grep "SidTypeUser" /tmp/lookupsid_raw.txt | grep -v '\$' | \

  awk -F'\' '{print $2}' | awk '{print $1}' > /tmp/userlist.txt



cat /tmp/userlist.txt

# Administrator

# Guest

# john.doe

# svc_sql

# helpdesk



# Estrai anche i computer account separatamente

grep "SidTypeUser" /tmp/lookupsid_raw.txt | grep '\$' | \

  awk -F'\' '{print $2}' | awk '{print $1}' > /tmp/computerlist.txt

Typical workflow in a pentest #

text


1. Scopri porta 445 aperta → prova null/guest session prima

   impacket-lookupsid ''@TARGET -no-pass 2>/dev/null | head -5

   → se stampa utenti → hai enumerazione anonima



2. Con credenziali low-priv → esegui su DC per lista completa

   impacket-lookupsid corp.local/user:pass@DC_IP > raw.txt



3. Estrai:

   - Domain SID → per Golden/Silver Ticket

   - Username list → per password spraying

   - Gruppi privilegiati → chi è in Domain Admins?



4. Usa la lista per attacchi successivi

   → /articoli/password-spraying → spray con username trovati

   → /articoli/getnpusers → testa ogni utente per AS-REP Roasting

Comparison with equivalent instruments #

|——|———–|———–|——————-|—————-|

| samrdump.py | SAMR/SMB 445 | ❌ Win10+ | ❌ No | ✅ Yes |

| GetADUsers.py | LDAP 389 | ❌ No | ❌ No | ❌ No |

When to prefer lookupsid:

You don't have credentials but the Guest account is enabled
You need the exact domain SID
LDAP 389 is filtered or unavailable
Do you want to enumerate local accounts? e of domination in one fell swoop

Common mistakes #

| Error | Cause | Solution |

|——–|——-|———–|

| STATUS_LOGON_FAILURE | Incorrect credentials | Verify user:pass |

| STATUS_ACCESS_DENIED | Account without LSARPC access | Try a more privileged account |

| No output after Domain SID | maxRid too low | Increase to 10000 for large domains |

| Connection refused | Port 445 closed | SMB Verify open |

| Guest account locked | Guest disabled (default Win10+) | Use valid credentials |

Cheat sheet #

bash


# Base con credenziali

impacket-lookupsid corp.local/user:pass@TARGET



# Null session (legacy/Samba)

impacket-lookupsid ''@TARGET -no-pass



# Guest account (HTB, ambienti legacy)

impacket-lookupsid corp.local/guest@TARGET -no-pass



# maxRid aumentato per domini grandi

impacket-lookupsid corp.local/user:pass@TARGET 10000



# Pass-the-Hash

impacket-lookupsid -hashes :NThash corp.local/user@TARGET



# Estrai Domain SID

impacket-lookupsid corp.local/user:pass@TARGET | grep "Domain SID"



# Estrai username list (no computer account)

impacket-lookupsid corp.local/guest@TARGET -no-pass | \

  grep "SidTypeUser" | grep -v '\$' | \

  awk -F'\' '{print $2}' | awk '{print $1}' > userlist.txt



# Via Kerberos

export KRB5CCNAME=ticket.ccache

impacket-lookupsid -k -no-pass corp.local/user@TARGET.FQDN