Skip to content
HackIndex logo

HackIndex

MSRPC SID Brute Forcing

1 min read Jul 10, 2026

Domain SID base from lsaquery; brute RIDs to resolve names. Anonymous works on permissive DCs.

Impacket lookupsid

Anonymous brute:

┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid anonymous@$TARGET_IP
Explain command
$TARGET_IP Target IP address passed as argument to the script.

Starts from known base; outputs valid username (RID).

Authenticated:

┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP
Explain command
$DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP Target credentials and host in DOMAIN/user:pass@IP format for SMB auth

Valid hits show username/group. Extract:

┌──(kali㉿kali)-[~]
└─$ grep -v "None" output.txt
Explain command
-v Invert match, printing lines that do NOT match the pattern.
"None" The pattern string to match and exclude from output.
output.txt Input file to search through.

Valid usernames from SID brute-forcing feed directly into AD Password Spraying. To confirm which discovered accounts have pre-authentication disabled, see Kerberos Valid User Enumeration.

References