trustedsec/ridenum — pull request #2 by tomsteele (2013-04-30 04:00:39+00:00)
Title: Change single sid lookup to all sids at once without OSError

Using a range and list comprehension this builds the command to lookup all sids in a range using a single call to rpcclient. This will increase speed significantly. Other changes include spaces for tabs and other PEP 8 compliant changes. Adding a .gitignore file as well.

Now uses chunks of 5000 sids to prevent an argument too long error returned from the OS.

Takes about 15 seconds to complete 500000 sids
tom@teemo ~/Code/ridenum $ time python rid_enum.py 192.168.1.28 500 500000
[*] Attempting lsaquery first...This will enumerate the base domain SID
[*] Successfully enumerated base domain SID.. Moving on to extract via RID
[*] Enumerating user accounts.. This could take a little while.
Account name: WUT\Administrator
Account name: WUT\Guest
Account name: WUT\krbtgt
Account name: WUT\Domain Admins
Account name: WUT\Domain Users
Account name: WUT\Domain Guests
Account name: WUT\Domain Computers
Account name: WUT\Domain Controllers
Account name: WUT\Cert Publishers
Account name: WUT\Schema Admins
Account name: WUT\Enterprise Admins
Account name: WUT\Group Policy Creator Owners
Account name: WUT\RAS and IAS Servers
Account name: WUT\HelpServicesGroup
Account name: WUT\SUPPORT_388945a0
Account name: WUT\TelnetClients
Account name: WUT\TEST-258825CDDF$
Account name: WUT\alincoln
[*] Finished enumerating user accounts... Seemed to be successful.

real	0m15.433s
user	0m10.388s
sys	0m2.586s